# data[].attributes.body
This week we completed two case studies and answered questions regarding each case study. Here are my takeaways.

1. I was quite blown away reading this case studies knowing that these are actual events that very likely do happen. For the first case study I felt that the patient was continuously ignored despite her symptoms worsening. With her pmhx including cancer, I would have been sure to take her symptoms seriously rather than trying to undermine it and misdiagnose her. From this study, I learned to never undermine a patients pain and aim to find the root of the cause rather than brushing it off with medication.

2. The second case study really was shocking to me. Again, I am sure an event like this is likely to happen but I was really taken back by both the PCP and oncologist ignoring the results thinking the other would review it. With this lack of communication, they failed their patient. Their failure to act resulted in her death. In addition, the PCP continued to fail her multiple times but not ordered appropriate testing and then not reviewing the results of her MRI. From this case study, I learned to always review patients results and if in any case where I am unable to review it, I will ensure that someone does so if the result is abnormal, it can be acted on immediately.

# data[].attributes.headline
The checklist to the ideal digital patient experience!

# data[].attributes.subject
The checklist to the ideal digital patient experience!

# data[].attributes.headline
5 Ways to use Data Visualization in Healthcare!

# data[].attributes.subject
5 Ways to use Data Visualization in Healthcare!

# data[].attributes.body
This week we learned about data visualization and how this can enhance the healthcare experience for a patient. Here are my takeaways.

1. People learn in different ways. While some may be able to interpret data as is, others are more visual learners. Adopting visual data into healthcare can help improve patient engagement by helping patients feel less intimidated and instead, offer them a better understanding.

2. Data visualization can dramatically enhance patient engagement by closing the gap between healthcare professionals and patients who may not know how to interpret data being able to fully immerse themselves in their care by having a better understanding through a visual interpretation.

# data[].attributes.attachment_link.readable_text
Analyzing data is no longer just for the data team. When more people are able to analyze data within an organization, the business generally performs better. In fact, 87% of respondents to a recent Harvard Business Review survey indicated that their organizations would be more efficient if their front-line workers were more empowered with data.

However, finding insights is just the first step in driving change. The real value comes when people can use insights to weave a narrative that drives action and makes a tangible impact.

In this article, we'll explore what a data story is and how you can create a clear and concise narrative around your data.

What is a data story?

A data story is a narrative constructed around a set of data that puts it into context and frames the broader implications. Unlike business intelligence or data science that emphasizes the technical task of turning data into insights, a data story brings these insights together with qualitative analysis and domain expertise to better understand a relevant business goal or objective.

What is data storytelling?

Data storytelling is the skill to craft the narrative by leveraging data, which is then contextualized, and finally presented to an audience. It utilizes not only data analysis and statistics, but also data visualization, qualitative and contextual analysis, and presentation.

Why is telling a story with data important?

Telling a story with data is important because it allows the narrator to put the data into context of a broader objective and use tools such as visual aids to help break down the results so that the audience, regardless of their background, domain expertise, or technical sophistication, can easily understand them and their implications.

Data storytelling also helps to explain data to people of different learning styles and allows the narrator to craft the communication methods to the respective audience. For instance, an auditory learner may respond better to a spoken presentation while a visual learner may require more data visualizations and other visual aids. In general, a good data story will include a combination of these various components so a diverse audience can stay engaged.

Data stories vs. data visualizations

Data stories are often compared with data visualizations. However, data visualizations are actually just one piece of data stories and are used as an aid to tell a broader story.

Data visualizations certainly help deliver various points in a narrative, but data storytelling also relies on industry or topic expertise and communication skills to help craft the data analysis and visualizations into something that can explain the who, what, why, and how of a broader story.

For instance, you could create a series of data visualizations around the change in sales over time for a specific product line. The visualizations may make it clear that there is a change occurring in the trend of the sales, but a data story would allow you to put this into context of broader themes such as marketing campaigns or supply chain constraints limiting inventory.

How to tell a story with data

While data storytelling is a broad process that can vary in its technical nature and domain, there are several key components that can be applied to any successful data story:

1. Find the story within the data

Before constructing a data story, you must first determine what the data is actually telling you. For instance, a correlation or causal link in a dataset may provide an interesting insight that can inform a more meaningful narrative. This provides a starting point into building a data story that can be conveyed to a larger and potentially technically diverse audience.

2. Consider your audience

The next step is to determine who the story will be conveyed to and what their backgrounds are. This is important in determining the technical complexity of the analysis and what components of the story the listeners will want to learn about. For example, an executive team will likely be more interested in understanding the broader business implications, while a data science team will be more focused on the statistical aspects.

3. Determine what data matters

It's common to get overwhelmed with data when constructing a data story. Modern businesses collect so much information that determining which datasets are most relevant to the broader narrative can be challenging. In general, it's important to start by identifying the data that can inform the topics you'll want to explore instead of looking at all the possible data available. For example, if you're planning on telling a story about customer experience then product usage data, sales data, and customer feedback may all be relevant, but employee experience data may not be. Doing so will ensure that the key points do not get diluted and that listeners or readers do not get distracted.

4. Analyze data and find insights

With the most relevant data identified, the next step is to perform data analysis to find insights that create meaning out of the data. Perhaps there's a correlation between some key datasets that was not otherwise understood, or there was a spike or dip in activity around a certain time. Digging into these relationships and patterns can help to provide the general themes of the data story.

ThoughtSpot's AI-Powered Analytics helps companies analyze and take action on all their datasets. Using a platform like ThoughtSpot can help data storytellers to quickly drill down and extract valuable insights about their data.

5. Identify the most effective data visualizations

Data visualizations are a powerful way to help an audience understand data concepts. However, there are so many different types of visualizations so it's important to pick one that best represents your data. For instance, if you're showing a trend over time, it's likely you'll want some type of chart that includes time series information.

If you're not sure about what visualization best represents your data, you can search in ThoughtSpot, which will use AI to provide recommendations on the best visualizations to represent your question. With Liveboards, you can go beyond static charts and use interactive visualizations that you can explore in real time.

6. Provide context

Data on its own is not enough to create an optimal data story. The domain expertise around the topic is essential to crafting the right narrative, and making it understandable to the audience. Therefore, it's critical to weave context and data insights together. This doesn't just mean providing an overview at the beginning before diving into data visualizations. It means framing the data insights with the business reality and any other relevant information that your audience may not otherwise be familiar with throughout the entire story.

Perhaps a correlation is caused by something that is very specific to an industry or business segment, or maybe there's an anomaly in the data that is impacted by an external event. Pointing these out will be important to provide sufficient context to understand the broader narrative.

7. Structure your story

Telling a traditional story often includes providing an introduction, a rising action that builds tension through problems, a climax that provides a crucial moment or insight, a falling action that resolves the problems, and a final resolution and retrospection.

This type of flow is often still valuable in telling a data story. Leveraging a structure that people are familiar with will help capture their attention, create a framework for information consumption they're already familiar with, and allow them to better understand the relevance and importance of the story that the data is telling.

8. Edit until the story is clear and concise

When presenting a data story, regardless of the topic, it's important that the story is clean and to the point. As with other writing and presentation, you should continuously review and edit the narrative until it's extremely clear. As Blaise Pascal famously said "If I had more time, I would have written a shorter letter." The same is true for data stories. Avoiding fluff that distracts from the main points is critical to ensure the audience is focused on what really matters.

Storytelling visualization examples

Visualizations are an essential part of a data story. A big part of building out an effective data story is selecting and building visualizations that provide the most impact. Here we'll dive into a couple examples of effective visualizations that guide a broader narrative.

Homelessness in America

In this blog about trends of homelessness in America, the author provides several examples of impactful charts. For example, in the following graph, the author is able to segment homeless data by state and includes a color-based density indicator so that viewers can quickly see where homelessness is particularly acute across the US. While the raw data is likely large and complex, this visualization allows us to quickly understand the implications with very little technical competency required.

Are hurricanes getting worse?

In this next blog on whether hurricane severity is increasing, the author provides more time-based visualizations. This makes sense, as the narrative is around the acceleration of various severity measures of storms. For instance, the following chart clearly shows that total monetary damage has grown extremely fast in aggregate in recent decades.

5 Tips for an effective data story

Now that we have a good understanding of how to build a clear data story, let's dive into a few final tips and tricks that can help ensure the narrative is as effective as possible:

1. Visuals are necessary

As we saw in the previous section, visuals are a great way to represent otherwise high volume or dense data into a way that's quickly comprehendible to the viewer. These visualizations are likely what most viewers are going to anchor on when you're presenting, so it's important to pick ones that best represent the insights and present clear evidence of the point you're trying to make.

2. Relevance is key

Data stories are often packed with information and therefore you should only include points that are relevant to your core narrative. Tangential or otherwise irrelevant data will just distract your audience so should not be included in the presentation.

3. Data must be timely

Trends and correlations can change quickly. Therefore, you should use the most up-to-date data possible to ensure that the analysis is fresh and not telling an outdated story. Using augmented analytics, ThoughtSpot also auto analyzes your data and alerts users to identified patterns and trends.

ThoughtSpot's generative AI capabilities help companies analyze and interact with your live data so that your story is always relevant.

4. Use data ethically

While using relevant data is important, you should also not cherry-pick data to tell in inaccurate narrative, nor should you present misleading relationships such as spurious correlations. While it may be tempting to use data to prove a point that benefits you, this is not only unethical but also doesn't help tell a true story.

5. Create a clear narrative

In the end, data storytelling is a form of presentation - often through public speaking - and therefore you should strive for telling a clear narrative that the audience can easily follow. Speak clearly and slowly and avoid tangents or irrelevant points.

What story do you want to tell?

Data storytelling is a powerful tool for conveying otherwise complex data to an audience. It involves constructing a clear and relevant narrative, analyzing and visualizing data, and presenting all the information in a coherent manner.

However, doing so requires having up-to-date data, fast and comprehensive analytics, and flexible yet easy-to-understand visualizations. With ThoughtSpot you can search, analyze, and visualize all of your data in one place. Try a free trial of ThoughtSpot to see how you can leverage the AI-Powered Analytics to build an effective and clear data story.

# data[].attributes.attachment_link.title
Data Storytelling: How to Tell a Great Story with Data

# data[].attributes.attachment_link.description
Data storytelling is the skill to craft the narrative by leveraging data, which is then contextualized, and presented to an audience. See how to create one.

# data[].attributes.body
This week we learned about storytelling as a way of showcasing data. Here are my takeaways.

1. Data can often be intimidating to most people. By breaking down the numbers into a simple and concise way, can help people feel less intimidated and understand the information given to them.

2. Storytelling is an important aspect of captivating our audience in connection to the presenting data. My giving your audience a story and giving meaning to the data, your audience is able to stay more engaged as they form a connection to the story and thus, the data.

# data[].attributes.attachment_link.readable_text
This is a summary of key elements of the Privacy Rule including who is covered, what information is protected, and how protected health information can be used and disclosed. Because it is an overview of the Privacy Rule, it does not address every detail of each provision.
Summary of the Privacy Rule
Introduction

The Standards for Privacy of Individually Identifiable Health Information ("Privacy Rule") establishes, for the first time, a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services ("HHS") issued the Privacy Rule to implement the requirement of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA").¹ The Privacy Rule standards address the use and disclosure of individuals' health information-called "protected health information" by organizations subject to the Privacy Rule - called "covered entities," as well as standards for individuals' privacy rights to understand and control how their health information is used. Within HHS, the Office for Civil Rights ("OCR") has responsibility for implementing and enforcing the Privacy Rule with respect to voluntary compliance activities and civil money penalties.

A major goal of the Privacy Rule is to assure that individuals' health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public's health and well being. The Rule strikes a balance that permits important uses of information, while protecting the privacy of people who seek care and healing. Given that the health care marketplace is diverse, the Rule is designed to be flexible and comprehensive to cover the variety of uses and disclosures that need to be addressed.

This is a summary of key elements of the Privacy Rule and not a complete or comprehensive guide to compliance. Entities regulated by the Rule are obligated to comply with all of its applicable requirements and should not rely on this summary as a source of legal information or advice. To make it easier for entities to review the complete requirements of the Rule, provisions of the Rule referenced in this summary are cited in the end notes. Visit ourPrivacy Rule section to view the entire Rule, and for other additional helpful information about how the Rule applies. In the event of a conflict between this summary and the Rule, the Rule governs.
Statutory and Regulatory Background

The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, was enacted on August 21, 1996. Sections 261 through 264 of HIPAA require the Secretary of HHS to publicize standards for the electronic exchange, privacy and security of health information. Collectively these are known as the Administrative Simplification provisions.

HIPAA required the Secretary to issue privacy regulations governing individually identifiable health information, if Congress did not enact privacy legislation within three years of the passage of HIPAA. Because Congress did not enact privacy legislation, HHS developed a proposed rule and released it for public comment on November 3, 1999. The Department received over 52,000 public comments. The final regulation, the Privacy Rule, was published December 28, 2000.²
In March 2002, the Department proposed and released for public comment modifications to the Privacy Rule. The Department received over 11,000 comments.The final modifications were published in final form on August 14, 2002. ³ A text combining the final regulation and the modifications can be found at 45 CFR Part 160 and Part 164, Subparts A and E.

Who is Covered by the Privacy Rule
The Privacy Rule, as well as all the Administrative Simplification rules, apply to health plans, health care clearinghouses, and to any health care provider who transmits health information in electronic form in connection with transactions for which the Secretary of HHS has adopted standards under HIPAA (the "covered entities"). For help in determining whether you are covered, use CMS's decision tool.

Health Care Providers. Every health care provider, regardless of size, who electronically transmits health information in connection with certain transactions, is a covered entity. These transactions include claims, benefit eligibility inquiries, referral authorization requests, or other transactions for which HHS has established standards under the HIPAA Transactions Rule. ⁶ Using electronic technology, such as email, does not mean a health care provider is a covered entity; the transmission must be in connection with a standard transaction. The Privacy Rule covers a health care provider whether it electronically transmits these transactions directly or uses a billing service or other third party to do so on its behalf. Health care providers include all "providers of services" (e.g., institutional providers such as hospitals) and "providers of medical or health services" (e.g., non-institutional providers such as physicians, dentists and other practitioners) as defined by Medicare, and any other person or organization that furnishes, bills, or is paid for health care.

Health Care Clearinghouses. Health care clearinghouses are entities that process nonstandard information they receive from another entity into a standard (i.e., standard format or data content), or vice versa. ⁷ In most instances, health care clearinghouses will receive individually identifiable health information only when they are providing these processing services to a health plan or health care provider as a business associate. In such instances, only certain provisions of the Privacy Rule are applicable to the health care clearinghouse's uses and disclosures of protected health information. ⁸ Health care clearinghouses include billing services, repricing companies, community health management information systems, and value-added networks and switches if these entities perform clearinghouse functions.
Business Associates
Business Associate Defined. In general, a business associate is a person or organization, other than a member of a covered entity's workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information. Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing. ⁹ Business associate services to a covered entity are limited to legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services. However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all. A covered entity can be the business associate of another covered entity.

Business Associate Contract. When a covered entity uses a contractor or other non-workforce member to perform "business associate" services or activities, the Rule requires that the covered entity include certain protections for the information in a business associate agreement (in certain circumstances governmental entities may use alternative means to achieve the same protections). In the business associate contract, a covered entity must impose specified written safeguards on the individually identifiable health information used or disclosed by its business associates. ¹⁰ Moreover, a covered entity may not contractually authorize its business associate to make any use or disclosure of protected health information that would violate the Rule. Covered entities that had an existing written contract or agreement with business associates prior to October 15, 2002, which was not renewed or modified prior to April 14, 2003, were permitted to continue to operate under that contract until they renewed the contract or April 14, 2004, whichever was first. ¹¹ See additional guidance on Business Associates and sample business associate contract language.
What Information is Protected
Protected Health Information. The Privacy Rule protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information "protected health information (PHI)." ¹²

"Individually identifiable health information" is information, including demographic data, that relates to:

the individual's past, present or future physical or mental health or condition,

the provision of health care to the individual, or

the past, present, or future payment for the provision of health care to the individual,

and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual. ¹³ Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number).

The Privacy Rule excludes from protected health information employment records that a covered entity maintains in its capacity as an employer and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g.
General Principle for Uses and Disclosures
Basic Principle. A major purpose of the Privacy Rule is to define and limit the circumstances in which an individual's protected heath information may be used or disclosed by covered entities. A covered entity may not use or disclose protected health information, except either: (1) as the Privacy Rule permits or requires; or (2) as the individual who is the subject of the information (or the individual's personal representative) authorizes in writing. ¹⁶
Permitted Uses and Disclosures
Permitted Uses and Disclosures. A covered entity is permitted, but not required, to use and disclose protected health information, without an individual's authorization, for the following purposes or situations: (1) To the Individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations. ¹⁸ Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make.

(1) To the Individual. A covered entity may disclose protected health information to the individual who is the subject of the information.

Most uses and disclosures of psychotherapy notes for treatment, payment, and health care operations purposes require an authorization as described below. ²³ Obtaining "consent" (written permission from individuals to use and disclose their protected health information for treatment, payment, and health care operations) is optional under the Privacy Rule for all covered entities. ²⁴ The content of a consent form, and the process for obtaining consent, are at the discretion of the covered entity electing to seek consent.

(3) Uses and Disclosures with Opportunity to Agree or Object. Informal permission may be obtained by asking the individual outright, or by circumstances that clearly give the individual the opportunity to agree, acquiesce, or object. Where the individual is incapacitated, in an emergency situation, or not available, covered entities generally may make such uses and disclosures, if in the exercise of their professional judgment, the use or disclosure is determined to be in the best interests of the individual.

(5) Public Interest and Benefit Activities. The Privacy Rule permits use and disclosure of protected health information, without an individual's authorization or permission, for 12 national priority purposes. ²⁸ These disclosures are permitted, although not required, by the Rule in recognition of the important uses made of health information outside of the health care context. Specific conditions or limitations apply to each public interest purpose, striking the balance between the individual privacy interest and the public interest need for this information.

Public Health Activities. Covered entities may disclose protected health information to: (1) public health authorities authorized by law to collect or receive such information for preventing or controlling disease, injury, or disability and to public health or other government authorities authorized to receive reports of child abuse and neglect; (2) entities subject to FDA regulation regarding FDA regulated products or activities for purposes such as adverse event reporting, tracking of products, product recalls, and post-marketing surveillance; (3) individuals who may have contracted or been exposed to a communicable disease when notification is authorized by law; and (4) employers, regarding employees, when requested by employers, for information concerning a work-related illness or injury or workplace related medical surveillance, because such information is needed by the employer to comply with the Occupational Safety and Health Administration (OHSA), the Mine Safety and Health Administration (MHSA), or similar state law. ³⁰ See additional guidance on Public Health Activities and CDC's web pages on Public Health and HIPAA Guidance.

Cadaveric Organ, Eye, or Tissue Donation. Covered entities may use or disclose protected health information to facilitate the donation and transplantation of cadaveric organs, eyes, and tissue. ³⁶

Research. "Research" is any systematic investigation designed to develop or contribute to generalizable knowledge. ³⁷ The Privacy Rule permits a covered entity to use and disclose protected health information for research purposes, without an individual's authorization, provided the covered entity obtains either: (1) documentation that an alteration or waiver of individuals' authorization for the use or disclosure of protected health information about them for research purposes has been approved by an Institutional Review Board or Privacy Board; (2) representations from the researcher that the use or disclosure of the protected health information is solely to prepare a research protocol or for similar purpose preparatory to research, that the researcher will not remove any protected health information from the covered entity, and that protected health information for which access is sought is necessary for the research; or (3) representations from the researcher that the use or disclosure sought is solely for research on the protected health information of decedents, that the protected health information sought is necessary for the research, and, at the request of the covered entity, documentation of the death of the individuals about whom information is sought. ³⁸ A covered entity also may use or disclose, without an individuals' authorization, a limited data set of protected health information for research purposes (see discussion below). ³⁹ See additional guidance on Research and NIH's publication of "Protecting Personal Health Information in Research: Understanding the HIPAA Privacy Rule."

Workers' Compensation. Covered entities may disclose protected health information as authorized by, and to comply with, workers' compensation laws and other similar programs providing benefits for work-related injuries or illnesses. ⁴² See additional guidance on Workers' Compensation.

(6) Limited Data Set. A limited data set is protected health information from which certain specified direct identifiers of individuals and their relatives, household members, and employers have been removed.43 A limited data set may be used and disclosed for research, health care operations, and public health purposes, provided the recipient enters into a data use agreement promising specified safeguards for the protected health information within the limited data set.
Authorized Uses and Disclosures
An authorization must be written in specific terms. It may allow use and disclosure of protected health information by the covered entity seeking the authorization, or by a third party. Examples of disclosures that would require an individual's authorization include disclosures to a life insurer for coverage purposes, disclosures to an employer of the results of a pre-employment physical or lab test, or disclosures to a pharmaceutical firm for their own marketing purposes.

All authorizations must be in plain language, and contain specific information regarding the information to be disclosed or used, the person(s) disclosing and receiving the information, expiration, right to revoke in writing, and other data. The Privacy Rule contains transition provisions applicable to authorizations and other express legal permissions obtained prior to April 14, 2003. ⁴⁶

The covered entity who originated the notes may use them for treatment.

A covered entity may use or disclose, without an individual's authorization, the psychotherapy notes, for its own training, and to defend itself in legal proceedings brought by the individual, for HHS to investigate or determine the covered entity's compliance with the Privacy Rules, to avert a serious and imminent threat to public health or safety, to a health oversight agency for lawful oversight of the originator of the psychotherapy notes, for the lawful activities of a coroner or medical examiner or as required by law.

Marketing. Marketing is any communication about a product or service that encourages recipients to purchase or use the product or service. ⁴⁹ The Privacy Rule carves out the following health-related activities from this definition of marketing:

Communications to describe health-related products or services, or payment for them, provided by or included in a benefit plan of the covered entity making the communication;

Communications about participating providers in a provider or health plan network, replacement of or enhancements to a health plan, and health-related products or services available only to a health plan's enrollees that add value to, but are not part of, the benefits plan;

Communications for treatment of the individual; and

Communications for case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or care settings to the individual.

Marketing also is an arrangement between a covered entity and any other entity whereby the covered entity discloses protected health information, in exchange for direct or indirect remuneration, for the other entity to communicate about its own products or services encouraging the use or purchase of those products or services. A covered entity must obtain an authorization to use or disclose protected health information for marketing, except for face-to-face marketing communications between a covered entity and an individual, and for a covered entity's provision of promotional gifts of nominal value. No authorization is needed, however, to make a communication that falls within one of the exceptions to the marketing definition. An authorization for marketing that involves the covered entity's receipt of direct or indirect remuneration from a third party must reveal that fact. See additional guidance on Marketing.
Limiting Uses and Disclosures to the Minimum Necessary
The minimum necessary requirement is not imposed in any of the following circumstances: (a) disclosure to or a request by a health care provider for treatment; (b) disclosure to an individual who is the subject of the information, or the individual's personal representative; (c) use or disclosure made pursuant to an authorization; (d) disclosure to HHS for complaint investigation, compliance review or enforcement; (e) use or disclosure that is required by law; or (f) use or disclosure required for compliance with the HIPAA Transactions Rule or other HIPAA Administrative Simplification Rules.

Access and Uses. For internal uses, a covered entity must develop and implement policies and procedures that restrict access and uses of protected health information based on the specific roles of the members of their workforce. These policies and procedures must identify the persons, or classes of persons, in the workforce who need access to protected health information to carry out their duties, the categories of protected health information to which access is needed, and any conditions under which they need the information to do their jobs.

Disclosures and Requests for Disclosures. Covered entities must establish and implement policies and procedures (which may be standard protocols) for routine, recurring disclosures, or requests for disclosures, that limits the protected health information disclosed to that which is the minimum amount reasonably necessary to achieve the purpose of the disclosure. Individual review of each disclosure is not required. For non-routine, non-recurring disclosures, or requests for disclosures that it makes, covered entities must develop criteria designed to limit disclosures to the information reasonably necessary to accomplish the purpose of the disclosure and review each of these requests individually in accordance with the established criteria.

Reasonable Reliance. If another covered entity makes a request for protected health information, a covered entity may rely, if reasonable under the circumstances, on the request as complying with this minimum necessary standard. Similarly, a covered entity may rely upon requests as being the minimum necessary protected health information from: (a) a public official, (b) a professional (such as an attorney or accountant) who is the covered entity's business associate, seeking the information to provide services to or for the covered entity; or (c) a researcher who provides the documentation or representation required by the Privacy Rule for research.
Notice and Other Individual Rights

Notice Distribution. A covered health care provider with a direct treatment relationship with individuals must have delivered a privacy practices notice to patients starting April 14, 2003 as follows:

Not later than the first service encounter by personal delivery (for patient visits), by automatic and contemporaneous electronic response (for electronic service delivery), and by prompt mailing (for telephonic service delivery);

By posting the notice at each service delivery site in a clear and prominent place where people seeking service may reasonably be expected to be able to read the notice; and

In emergency treatment situations, the provider must furnish its notice as soon as practicable after the emergency abates.

Covered entities, whether direct treatment providers or indirect treatment providers (such as laboratories) or health plans must supply notice to anyone on request. ⁵² A covered entity must also make its notice electronically available on any web site it maintains for customer service or benefits information.

The covered entities in an organized health care arrangement may use a joint privacy practices notice, as long as each agrees to abide by the notice content with respect to the protected health information created or received in connection with participation in the arrangement. ⁵³ Distribution of a joint notice by any covered entity participating in the organized health care arrangement at the first point that an OHCA member has an obligation to provide notice satisfies the distribution obligation of the other participants in the organized health care arrangement.

A health plan must distribute its privacy practices notice to each of its enrollees by its Privacy Rule compliance date. Thereafter, the health plan must give its notice to each new enrollee at enrollment, and send a reminder to every enrollee at least once every three years that the notice is available upon request. A health plan satisfies its distribution obligation by furnishing the notice to the "named insured," that is, the subscriber for coverage that also applies to spouses and dependents.

Acknowledgement of Notice Receipt. A covered health care provider with a direct treatment relationship with individuals must make a good faith effort to obtain written acknowledgement from patients of receipt of the privacy practices notice.⁵⁴ The Privacy Rule does not prescribe any particular content for the acknowledgement. The provider must document the reason for any failure to obtain the patient's written acknowledgement. The provider is relieved of the need to request acknowledgement in an emergency treatment situation.

Access. Except in certain circumstances, individuals have the right to review and obtain a copy of their protected health information in a covered entity's designated record set. ⁵⁵ The "designated record set" is that group of records maintained by or for a covered entity that is used, in whole or part, to make decisions about individuals, or that is a provider's medical and billing records about individuals or a health plan's enrollment, payment, claims adjudication, and case or medical management record systems. ⁵⁶ The Rule excepts from the right of access the following protected health information: psychotherapy notes, information compiled for legal proceedings, laboratory results to which the Clinical Laboratory Improvement Act (CLIA) prohibits access, or information held by certain research laboratories. For information included within the right of access, covered entities may deny an individual access in certain specified situations, such as when a health care professional believes access could cause harm to the individual or another. In such situations, the individual must be given the right to have such denials reviewed by a licensed health care professional for a second opinion. ⁵⁷ Covered entities may impose reasonable, cost-based fees for the cost of copying and postage.

Disclosure Accounting. Individuals have a right to an accounting of the disclosures of their protected health information by a covered entity or the covered entity's business associates. ⁶⁰ The maximum disclosure accounting period is the six years immediately preceding the accounting request, except a covered entity is not obligated to account for any disclosure made before its Privacy Rule compliance date.

The Privacy Rule does not require accounting for disclosures: (a) for treatment, payment, or health care operations; (b) to the individual or the individual's personal representative; (c) for notification of or to persons involved in an individual's health care or payment for health care, for disaster relief, or for facility directories; (d) pursuant to an authorization; (e) of a limited data set; (f) for national security or intelligence purposes; (g) to correctional institutions or law enforcement officials for certain purposes regarding inmates or individuals in lawful custody; or (h) incident to otherwise permitted or required uses or disclosures. Accounting for disclosures to health oversight agencies and law enforcement officials must be temporarily suspended on their written representation that an accounting would likely impede their activities.

Confidential Communications Requirements. Health plans and covered health care providers must permit individuals to request an alternative means or location for receiving communications of protected health information by means other than those that the covered entity typically employs. ⁶³ For example, an individual may request that the provider communicate with the individual through a designated address or phone number. Similarly, an individual may request that the provider send communications in a closed envelope rather than a post card.

Health plans must accommodate reasonable requests if the individual indicates that the disclosure of all or part of the protected health information could endanger the individual. The health plan may not question the individual's statement of
endangerment. Any covered entity may condition compliance with a confidential communication request on the individual specifying an alternative address or method of contact and explaining how any payment will be handled.
Administrative Requirements
HHS recognizes that covered entities range from the smallest provider to the largest, multi-state health plan. Therefore the flexibility and scalability of the Rule are intended to allow covered entities to analyze their own needs and implement solutions appropriate for their own environment. What is appropriate for a particular covered entity will depend on the nature of the covered entity's business, as well as the covered entity's size and resources.

Privacy Policies and Procedures. A covered entity must develop and implement written privacy policies and procedures that are consistent with the Privacy Rule. ⁶⁴

Privacy Personnel. A covered entity must designate a privacy official responsible for developing and implementing its privacy policies and procedures, and a contact person or contact office responsible for receiving complaints and providing individuals with information on the covered entity's privacy practices. ⁶⁵

Workforce Training and Management. Workforce members include employees, volunteers, trainees, and may also include other persons whose conduct is under the direct control of the entity (whether or not they are paid by the entity). ⁶⁶ A covered entity must train all workforce members on its privacy policies and procedures, as necessary and appropriate for them to carry out their functions. ⁶⁷ A covered entity must have and apply appropriate sanctions against workforce members who violate its privacy policies and procedures or the Privacy Rule. ⁶⁸

Mitigation. A covered entity must mitigate, to the extent practicable, any harmful effect it learns was caused by use or disclosure of protected health information by its workforce or its business associates in violation of its privacy policies and procedures or the Privacy Rule. ⁶⁹

Among other things, the covered entity must identify to whom individuals can submit complaints to at the covered entity and advise that complaints also can be submitted to the Secretary of HHS.

Documentation and Record Retention. A covered entity must maintain, until six years after the later of the date of their creation or last effective date, its privacy policies and procedures, its privacy practices notices, disposition of complaints, and other actions, activities, and designations that the Privacy Rule requires to be documented. ⁷⁵

Fully-Insured Group Health Plan Exception. The only administrative obligations with which a fully-insured group health plan that has no more than enrollment data and summary health information is required to comply are the (1) ban on retaliatory acts and waiver of individual rights, and (2) documentation requirements with respect to plan documents if such documents are amended to provide for the disclosure of protected health information to the plan sponsor by a health insurance issuer or HMO that services the group health plan. ⁷⁶
Organizational Options
The Rule contains provisions that address a variety of organizational issues that may affect the operation of the privacy protections.

Affiliated Covered Entity. Legally separate covered entities that are affiliated by common ownership or control may designate themselves (including their health care components) as a single covered entity for Privacy Rule compliance. ⁷⁹ The designation must be in writing. An affiliated covered entity that performs multiple covered functions must operate its different covered functions in compliance with the Privacy Rule provisions applicable to those covered functions.

Covered Entities With Multiple Covered Functions. A covered entity that performs multiple covered functions must operate its different covered functions in compliance with the Privacy Rule provisions applicable to those covered functions. ⁸² The covered entity may not use or disclose the protected health information of an individual who receives services from one covered function (e.g., health care provider) for another covered function (e.g., health plan) if the individual is not involved with the other function.

Group Health Plan disclosures to Plan Sponsors. A group health plan and the health insurer or HMO offered by the plan may disclose the following protected health information to the "plan sponsor"-the employer, union, or other employee organization that sponsors and maintains the group health plan: ⁸³

Enrollment or disenrollment information with respect to the group health plan or a health insurer or HMO offered by the plan.

If requested by the plan sponsor, summary health information for the plan sponsor to use to obtain premium bids for providing health insurance coverage through the group health plan, or to modify, amend, or terminate the group health plan. "Summary health information" is information that summarizes claims history, claims expenses, or types of claims experience of the individuals for whom the plan sponsor has provided health benefits through the group health plan, and that is stripped of all individual identifiers other than five digit zip code (though it need not qualify as de-identified protected health information).

Protected health information of the group health plan's enrollees for the plan sponsor to perform plan administration functions. The plan must receive certification from the plan sponsor that the group health plan document has been amended to impose restrictions on the plan sponsor's use and disclosure of the protected health information. These restrictions must include the representation that the plan sponsor will not use or disclose the protected health information for any employment-related action or decision or in connection with any other benefit plan.

Other Provisions: Personal Representatives and Minors
Personal Representatives. The Privacy Rule requires a covered entity to treat a "personal representative" the same as the individual, with respect to uses and disclosures of the individual's protected health information, as well as the individual's rights under the Rule. ⁸⁴ A personal representative is a person legally authorized to make health care decisions on an individual's behalf or to act for a deceased individual or the estate. The Privacy Rule permits an exception when a
covered entity has a reasonable belief that the personal representative may be abusing or neglecting the individual, or that treating the person as the personal representative could otherwise endanger the individual.

Special Case: Minors. In most cases, parents are the personal representatives for their minor children. Therefore, in most cases, parents can exercise individual rights, such as access to the medical record, on behalf of their minor children. In certain exceptional cases, the parent is not considered the personal representative. In these situations, the Privacy Rule defers to State and other law to determine the rights of parents to access and control the protected health information of their minor children. If State and other law is silent concerning parental access to the minor's protected health information, a covered entity has discretion to provide or deny a parent access to the minor's health information, provided the decision is made by a licensed health care professional in the exercise of professional judgment. See additional guidance on Personal Representatives.
State Law
Exception Determination. In addition, preemption of a contrary State law will not occur if HHS determines, in response to a request from a State or other entity or person, that the State law:

Is necessary to prevent fraud and abuse related to the provision of or payment for health care,

Is necessary to ensure appropriate State regulation of insurance and health plans to the extent expressly authorized by statute or regulation,

Is necessary for State reporting on health care delivery or costs,

Is necessary for purposes of serving a compelling public health, safety, or welfare need, and, if a Privacy Rule provision is at issue, if the Secretary determines that the intrusion into privacy is warranted when balanced against the need to be served; or

Has as its principal purpose the regulation of the manufacture, registration, distribution, dispensing, or other control of any controlled substances (as defined in 21 U.S.C. 802), or that is deemed a controlled substance by State law.

Enforcement and Penalties for Noncompliance
Compliance. The Standards for Privacy of Individually Identifiable Health Information (Privacy Rule) establishes a set of national standards for the use and disclosure of an individual's health information - called protected health information - by covered entities, as well as standards for providing individuals with privacy rights to understand and control how their health information is used. The Department of Health and Human Services, Office for Civil Rights (OCR) is responsible for administering and enforcing these standards and may conduct complaint investigations and compliance reviews.

Consistent with the principles for achieving compliance provided in the Privacy Rule, OCR will seek the cooperation of covered entities and may provide technical assistance to help them comply voluntarily with the Privacy Rule. Covered entities that fail to comply voluntarily with the standards may be subject to civil money penalties. In addition, certain violations of the Privacy Rule may be subject to criminal prosecution. These penalty provisions are explained below.

Civil Money Penalties. OCR may impose a penalty on a covered entity for a failure to comply with a requirement of the Privacy Rule. Penalties will vary significantly depending on factors such as the date of the violation, whether the covered entity knew or should have known of the failure to comply, or whether the covered entity's failure to comply was due to willful neglect. Penalties may not exceed a calendar year cap for multiple violations of the same requirement.

Penalty Amount Per Violation

$127 - $63,973* per violation

Calendar Year Cap for Violation of Identical Requirement or Prohibition

$25,000 - $1,919,173**

*The Department of Health and Human Services may make annual adjustments to the CMP amounts pursuant to the Federal Civil Penalties Inflation Adjustment Act Improvement Act of 2015. The annual inflation amounts are found at 45 CFR § 102.3.
**Pursuant to HHS's Notification of Enforcement Discretion, https://www.federalregister.gov/documents/2019/04/30/2019-08530/enforcement-discretion-regarding-hipaa-civil-money-penalties

A penalty will not be imposed for violations in certain circumstances, such as if:

the failure to comply was not due to willful neglect, and was corrected during a 30-day period after the entity knew or should have known the failure to comply had occurred (unless the period is extended at the discretion of OCR); or

the Department of Justice has imposed a criminal penalty for the failure to comply (see below).

In addition, OCR may choose to reduce a penalty if the failure to comply was due to reasonable cause and the penalty would be excessive given the nature and extent of the noncompliance.

Before OCR imposes a penalty, it will notify the covered entity and provide the covered entity with an opportunity to provide written evidence of those circumstances that would reduce or bar a penalty. This evidence must be submitted to OCR within 30 days of receipt of the notice. In addition, if OCR states that it intends to impose a penalty, a covered entity has the right to request an administrative hearing to appeal the proposed penalty.

Criminal Penalties. A person who knowingly obtains or discloses individually identifiable health information in violation of the Privacy Rule may face a criminal penalty of up to $50,000 and up to one-year imprisonment. The criminal penalties increase to $100,000 and up to five years imprisonment if the wrongful conduct involves false pretenses, and to $250,000 and up to 10 years imprisonment if the wrongful conduct involves the intent to sell, transfer, or use identifiable health information for commercial advantage, personal gain or malicious harm. The Department of Justice is responsible for criminal prosecutions under the Priv
Compliance Dates
Compliance Schedule. All covered entities, except "small health plans," must have been compliant with the Privacy Rule by April 14, 2003. ⁹⁰ Small health plans, however, had until April 14, 2004 to comply.
Copies of the Rule & Related Materials
See our Combined Regulation Text of All Rules section of our site for the full suite of HIPAA Administrative Simplification Regulations and Understanding HIPAA for additional guidance material.
End Notes
¹ Pub. L. 104-191.
² 65 FR 82462.
³ 67 FR 53182.
⁴ 45 C.F.R. §§ 160.102, 160.103.
⁵ Even if an entity, such as a community health center, does not meet the definition of a health plan, it may, nonetheless, meet the definition of a health care provider, and, if it transmits health information in electronic form in connection with the transactions for which the Secretary of HHS has adopted standards under HIPAA, may still be a covered entity.
⁶ 45 C.F.R. §§ 160.102, 160.103; see Social Security Act § 1172(a)(3), 42 U.S.C. § 1320d-1(a)(3).
The transaction standards are established by the HIPAA Transactions Rule at 45 C.F.R. Part 162.
⁷ 45 C.F.R. § 160.103.
⁸ 45 C.F.R. § 164.500(b).
⁹ 45 C.F.R. § 160.103.
¹⁰ 45 C.F.R. §§ 164.502(e), 164.504(e).
¹¹ 45 C.F.R. § 164.532
¹² 45 C.F.R. § 160.103.
¹³ 45 C.F.R. § 160.103
¹⁴ 45 C.F.R. §§ 164.502(d)(2), 164.514(a) and (b).
¹⁵ The following identifiers of the individual or of relatives, employers, or household members of the individual must be removed to achieve the "safe harbor" method of de-identification: (A) Names; (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of Census (1) the geographic units formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000; (C) All elements of dates (except year) for dates directly related to the individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; (D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses: (G) Social security numbers; (H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers; (K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers; (N) Web Universal Resource Locators (URLs); (O) Internet Protocol (IP) address numbers; (P) Biometric identifiers, including finger and voice prints; (Q) Full face photographic images and any comparable images; and ® any other unique identifying number, characteristic, or code, except as permitted for re-identification purposes provided certain conditions are met. In addition to the removal of the above-stated identifiers, the covered entity may not have actual knowledge that the remaining information could be used alone or in combination with any other information to identify an individual who is subject of the information. 45 C.F.R. § 164.514(b).
¹⁶ 45 C.F.R. § 164.502(a).
¹⁷ 45 C.F.R. § 164.502(a)(2).
¹⁸ 45 C.F.R. § 164.502(a)(1).
¹⁹ 45 C.F.R. § 164.506(c).
²⁰ 45 C.F.R. § 164.501.
²¹ 45 C.F.R. § 164.501.
²² 45 C.F.R. § 164.501.
²³ 45 C.F.R. § 164.508(a)(2)
²⁴ 45 C.F.R. § 164.506(b).
²⁵ 45 C.F.R. § 164.510(a).
²⁶ 45 C.F.R. § 164.510(b).
²⁷ 45 C.F.R. §§ 164.502(a)(1)(iii).
²⁸ See 45 C.F.R. § 164.512.
²⁹ 45 C.F.R. § 164.512(a).
³⁰ 45 C.F.R. § 164.512(b).
³¹ 45 C.F.R. § 164.512(a), (c).
³² 45 C.F.R. § 164.512(d).
³³ 45 C.F.R. § 164.512(e).
³⁴ 45 C.F.R. § 164.512(f).
³⁵ 45 C.F.R. § 164.512(g).
³⁶ 45 C.F.R. § 164.512(h).
³⁷ The Privacy Rule defines research as, "a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge." 45 C.F.R. § 164.501.
³⁸ 45 C.F.R. § 164.512(i).
³⁹ 45 CFR § 164.514(e).
⁴⁰ 45 C.F.R. § 164.512(j).
⁴¹ 45 C.F.R. § 164.512(k).
⁴² 45 C.F.R. § 164.512(l).
⁴³ 45 C.F.R. § 164.514(e). A limited data set is protected health information that excludes the
following direct identifiers of the individual or of relatives, employers, or household members of
the individual: (i) Names; (ii) Postal address information, other than town or city, State and zip
code; (iii) Telephone numbers; (iv) Fax numbers; (v) Electronic mail addresses: (vi) Social
security numbers; (vii) Medical record numbers; (viii) Health plan beneficiary numbers; (ix)
Account numbers; (x) Certificate/license numbers; (xi) Vehicle identifiers and serial numbers,
including license plate numbers; (xii) Device identifiers and serial numbers; (xiii) Web Universal
Resource Locators (URLs); (xiv) Internet Protocol (IP) address numbers; (xv) Biometric
identifiers, including finger and voice prints; (xvi) Full face photographic images and any
comparable images. 45 C.F.R. § 164.514(e)(2).
⁴⁴ 45 C.F.R. § 164.508.
⁴⁵ A covered entity may condition the provision of health care solely to generate protected health information for disclosure to a third party on the individual giving authorization to disclose the information to the third party. For example, a covered entity physician may condition the provision of a physical examination to be paid for by a life insurance issuer on an individual's authorization to disclose the results of that examination to the life insurance issuer. A health plan may condition enrollment or benefits eligibility on the individual giving authorization, requested before the individual's enrollment, to obtain protected health information (other than psychotherapy notes) to determine the individual's eligibility or enrollment or for underwriting or risk rating. A covered health care provider may condition treatment related to research (e.g., clinical trials) on the individual giving authorization to use or disclose the individual's protected health information for the research. 45 C.F.R. 508(b)(4).
⁴⁶ 45 CFR § 164.532.
⁴⁷ "Psychotherapy notes" means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the of the individual's medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.
⁴⁵ C.F.R. § 164.501.
⁴⁸ 45 C.F.R. § 164.508(a)(2).
⁴⁹ 45 C.F.R. §§ 164.501 and 164.508(a)(3).
⁵⁰ 45 C.F.R. §§ 164.502(b) and 164.514 (d).
⁵¹ 45 C.F.R. §§ 164.520(a) and (b). A group health plan, or a health insurer or HMO with respect to the group health plan, that intends to disclose protected health information (including enrollment data or summary health information) to the plan sponsor, must state that fact in the notice. Special statements are also required in the notice if a covered entity intends to contact individuals about health-related benefits or services, treatment alternatives, or appointment reminders, or for the covered entity's own fundraising.
⁵² 45 C.F.R. § 164.520(c).
⁵³ 45 C.F.R. § 164.520(d).
⁵⁴ 45 C.F.R. § 164.520(c).
⁵⁵ 45 C.F.R. § 164.524.
⁵⁶ 45 C.F.R. § 164.501.
⁵⁷ A covered entity may deny an individual access, provided that the individual is given a right to have such denials reviewed by a licensed health care professional (who is designated by the covered entity and who did not participate in the original decision to deny), when a licensed health care professional has determined, in the exercise of professional judgment, that: (a) the access requested is reasonably likely to endanger the life or physical safety of the individual or another person; (b) the protected health information makes reference to another person (unless such other person is a health care provider) and the access requested is reasonably likely to cause substantial harm to such other person; or (c) the request for access is made by the individual's personal representative and the provision of access to such personal representative is reasonably likely to cause substantial harm to the individual or another person.

A covered entity may deny access to individuals, without providing the individual an opportunity for review, in the following protected situations: (a) the protected health information falls under an exception to the right of access; (b) an inmate request for protected health information under certain circumstances; (c) information that a provider creates or obtains in the course of research that includes treatment for which the individual has agreed not to have access as part of consenting to participate in the research (as long as access to the information is restored upon completion of the research); (d) for records subject to the Privacy Act, information to which access may be denied under the Privacy Act, 5 U.S.C. § 552a; and (e) information obtained under a promise of confidentiality from a source other than a health care provider, if granting access would likely reveal the source. 45 C.F.R. § 164.524.
⁵⁸ 45 C.F.R. § 164.526.
⁵⁹ Covered entities may deny an individual's request for amendment only under specified circumstances. A covered entity may deny the request if it: (a) may exclude the information from access by the individual; (b) did not create the information (unless the individual provides a reasonable basis to believe the originator is no longer available); (c) determines that the information is accurate and complete; or (d) does not hold the information in its designated record set. 164.526(a)(2).
⁶⁰ 45 C.F.R. § 164.528.
⁶¹ 45 C.F.R. § 164.522(a).
⁶² 45 C.F.R. § 164.522(a). In addition, a restriction agreed to by a covered entity is not effective under this subpart to prevent uses or disclosures permitted or required under §§ 164.502(a)(2)(ii), 164.510(a) or 164.512.
⁶³ 45 C.F.R. § 164.522(b).
⁶⁴ 45 C.F.R. § 164.530(i).
⁶⁵ 45 C.F.R. § 164.530(a).
⁶⁶ 45 C.F.R. §160.103.
⁶⁷ 45 C.F.R. § 164.530(b).
⁶⁸ 45 C.F.R. § 164.530(e).
⁶⁹ 45 C.F.R. § 164.530(f).
⁷⁰ 45 C.F.R. § 164.530(c).
⁷¹ 45 C.F.R. § 164.530(d).
⁷² 45 C.F.R. § 164.520(b)(1)(vi).
⁷³ 45 C.F.R. § 164.530(g).
⁷⁴ 45 C.F.R. § 164.530(h).
⁷⁵ 45 C.F.R. § 164.530(j).
⁷⁶ 45 C.F.R. § 164.530(k).
⁷⁷ 45 C.F.R. §§ 164.103, 164.105.
⁷⁸ 45 C.F.R. § 164.103.
⁷⁹ 45 C.F.R. §164.105. Common ownership exists if an entity possesses an ownership or equity interest of five percent or more in another entity; common control exists if an entity has the direct or indirect power significantly to influence or direct the actions or policies of another entity. 45 C.F.R. §§ 164.103.
⁸⁰ The Privacy Rule at 45 C.F.R. § 160.103 identifies five types of organized health care arrangements:

A clinically-integrated setting where individuals typically receive health care from more
than one provider.

An organized system of health care in which the participating covered entities hold themselves out to the public as part of a joint arrangement and jointly engage in utilization review, quality assessment and improvement activities, or risk-sharing payment activities.

A group health plan and the health insurer or HMO that insures the plan's benefits, with respect to protected health information created or received by the insurer or HMO that relates to individuals who are or have been participants or beneficiaries of the group health plan.

All group health plans maintained by the same plan sponsor.

All group health plans maintained by the same plan sponsor and all health insurers and HMOs that insure the plans' benefits, with respect to protected health information created or received by the insurers or HMOs that relates to individuals who are or have been participants or beneficiaries in the group health plans.

⁸¹ 45 C.F.R. § 164.506(c)(5).
⁸² 45 C.F.R. § 164.504(g).
⁸³ 45 C.F.R. § 164.504(f).
⁸⁴ 45 C.F.R. § 164.502(g).
⁸⁵ 45 C.F.R. §160.203.
⁸⁶ 45 C.F.R. § 160.202.
⁸⁷ 45 C.F.R.§ 160.304
⁸⁸ Pub. L. 104-191; 42 U.S.C. §1320d-5.
⁸⁹ Pub. L. 104-191; 42 U.S.C. §1320d-6.
⁹⁰ 45 C.F.R. § 164.534.
⁹¹ 45 C.F.R. § 160.103.
⁹² Fully insured health plans should use the amount of total premiums that they paid for health insurance benefits during the plan's last full fiscal year. Self-insured plans, both funded and unfunded, should use the total amount paid for health care claims by the employer, plan sponsor or benefit fund, as applicable to their circumstances, on behalf of the plan during the plan's last full fiscal year. Those plans that provide health benefits through a mix of purchased insurance and self-insurance should combine proxy measures to determine their total annual receipts.

# data[].attributes.headline
Do you know how to handle a HIPAA breach?

# data[].attributes.subject
Do you know how to handle a HIPAA breach?

# data[].attributes.body
This week, we discussed meeting HIPAA requirement and being compliant in the workspace. Here are my takeaways.

1. Sometimes we may forget the importance of HIPAA, especially when the workplace gets so busy. It can be easy to lose compliance accidentally. However, it is important to always keep HIPAA in mind and think of how to be HIPAA compliant the second patient information comes in to play.

2. Some of the ways we can be HIPAA compliant include, logging off of computers when stepping away to avoid anyone not authorized from looking at patient information, speaking to patients while being cautious of others around that are not authorized to hear that patients information and making the effort to not discuss patients or pertinent patient information outside the care team.

# data[].attributes.headline
How To Reduce Alert (Alarm) Fatigue in Healthcare

# data[].attributes.subject
How To Reduce Alert (Alarm) Fatigue in Healthcare

# data[].attributes.attachment_link.title
How To Reduce Alarm Fatigue for Doctors And Nurses In Hospitals

# data[].attributes.attachment_link.readable_text
Background

The rapidly increasing computerization of health care has produced benefits for clinicians and patients. Yet the integration of technology into medicine has been anything but smooth, and as newer and more sophisticated devices have been added to the clinical environment, clinicians' workflows have been affected in unanticipated ways. These fundamental shifts have resulted in new threats to patient safety-a cruel irony given that technological solutions have been promoted for many years as the most promising solution to medical errors.

Most health care technologies-be they computerized provider order entry systems (CPOE), smart intravenous infusion pumps, or cardiac monitoring devices-provide auditory or visual warnings to clinicians to prevent or act on unsafe situations. These warnings are well intended and in isolation may be helpful. However, in the current highly computerized clinical environment, an individual clinician interacts with many different alert-generating devices-meaning that every day, clinicians are on the receiving end of a staggering number of alerts. A 2014 study found that the physiologic monitors in an academic hospital's 66 adult intensive care unit beds generated more than 2 million alerts in one month, translating to 187 warnings per patient per day. In a study in the Veterans Affairs primary care, clinicians received more than 100 alerts per day.

The term alert fatigue describes how busy workers (in the case of health care, clinicians) become desensitized to safety alerts, and as a result ignore or fail to respond appropriately to such warnings. This phenomenon occurs because of the sheer number of alerts, and it is compounded by the fact that the vast majority of alerts generated by CPOE systems (and other health care technologies) are clinically inconsequential-meaning that in most cases, clinicians should ignore them. The problem is that clinicians then ignore both the bothersome, clinically meaningless alarms and the critical alerts that warn of impending serious patient harm. In essence, a proliferation of alerts that are intended to improve safety actually results in a paradoxical increase in the chance patients will be harmed. Although little discussed prior to the widespread use of electronic medical records, alert fatigue is now recognized as a major unintended consequence of the computerization of health care and a significant patient safety hazard.

Effect of alert fatigue on patient safety

Much of the literature on alert fatigue derives from studies of CPOE and clinical decision support systems, in which alerts are provided to warn of potentially harmful drug-drug interactions or incorrect medication doses. These studies consistently show three main findings:

Alerts are only modestly effective at best. A systematic review of computerized reminders found only minor improvements in targeted processes of care, and, while CPOE systems have been shown to markedly decrease prescribing errors, this can largely be ascribed to their ability to standardize drug doses, provide decision support, and eliminate errors from poor handwriting or incorrect transcriptions.

Alert fatigue is common. Clinicians generally override the vast majority of CPOE warnings, even "critical" alerts that warn of potentially severe harm. There is less literature on other types of warnings, but it is likely that rates of overriding or ignoring warnings in other settings are also high.

Alert fatigue increases with growing exposure to alerts and heavier use of CPOE systems. This finding is intuitive, but also raises the important implication that without system redesign, the safety consequences of alert fatigue will likely become more serious over time.

Although there are few studies that quantify adverse events related to alert fatigue, this phenomenon has been implicated as a significant cause in several high-profile errors. A 2011 Boston Globe investigation identified more than 200 deaths over a 5-year period attributable to failure to appropriately heed alarms from physiologic monitoring systems. A recent book by a prominent patient safety leader details how a hospitalized teenager received a 38-fold overdose of an antibiotic, in large part because the ordering physician had been advised by colleagues to "just ignore the alerts."

Current context

Although only recently recognized, alert fatigue (and the unintended consequences of the computerization of health care) has become a high profile patient safety issue. The Joint Commission released a sentinel event alert in April 2015 calling for health care organizations to pay close attention to information technology as a safety issue. In order to mitigate these consequences-including alert fatigue-The Joint Commission recommended improving the culture of safety by creating a shared sense of responsibility between users and developers, paying careful attention to safe IT implementation, and engaging leadership to provide oversight of health IT planning, implementation, and evaluation.

There is intense interest in developing specific methods to combat alert fatigue, but as yet, there is no consensus on the optimal approaches. Solving alert fatigue will require use of the principles of human factors engineering as well as those of informatics, as the problem fundamentally arises from both the technology itself and how busy human beings interact with the technology. A WebM&M provided several suggestions on how to minimize alert fatigue in CPOE systems:

Increase alert specificity by reducing or eliminating clinically inconsequential alerts.

Tailor alerts to patient characteristics and critical integrated clusters of physiologic indicators. For example, incorporate renal function test results into the alert system so that alerts for nephrotoxic medications are triggered only for patients at high risk.

Tier alerts according to severity. Warnings could be presented in different ways, in order to key clinicians to alerts that are more clinically consequential.

Make only high-level (severe) alerts interruptive.

Apply human factors principles when designing alerts (e.g., format, content, legibility, and color of alerts).

A quality improvement program in the Veterans Affairs system that incorporated the above principles and provided primary care physicians with education on managing alerts achieved a small but meaningful reduction in alerts.

One limitation to addressing alert fatigue pertains to the legal consequences of removing alerts. A recent commentary pointed out that system developers have thus far been reluctant to remove alerts for fear of being held liable if patients were harmed in the absence of a warning. There has been progress toward developing guidelines for high-severity alerts (which warn of significant risk of harm and should be retained) and low-severity alerts (less clinically consequential warnings, which could be made non-interruptive or removed entirely).

In solving the problem of alert fatigue, health care will need to look to examples from other industries. The aviation industry offers a sharp contrast to health care, because cockpit technology is rigorously designed to provide only highly consequential alerts to pilots, minimizing minor alerts in order to allow pilots to maintain situational awareness. This use of human factors engineering and deep attention to the experience of the end-user has thus far been lacking in health care technology design.

# data[].attributes.attachment_link.description
Alert fatigue (alarm fatigue) is when healthcare workers become desensitized to electronic safety alerts. Alert fatigue can lead to medical errors and adverse events.

# data[].attributes.body
This week we learned about alert fatigue. One of the takeaways I got from learning about alert fatigue was the importance of not overworking yourself to a point where you reach alert fatigue.

Another important takeaway I learned was how we can move away from alert fatigue by coming up with solutions. One student provided a great solution by having sounds indicate priority whether it’s low priority or an emergency. I think this would be extremely helpful in prioritizing tasks and ultimately help move healthcare workers away from alert fatigue.

# data[].attributes.attachment_link.readable_text
Abstract

A number of commentaries have suggested that large studies are more reliable than smaller studies and there is a growing interest in the analysis of "big data" that integrates information from many thousands of persons and/or different data sources. We consider a variety of biases that are likely in the era of big data, including sampling error, measurement error, multiple comparisons errors, aggregation error, and errors associated with the systematic exclusion of information. Using examples from epidemiology, health services research, studies on determinants of health, and clinical trials, we conclude that it is necessary to exercise greater caution to be sure that big sample size does not lead to big inferential errors. Despite the advantages of big studies, large sample size can magnify the bias associated with error resulting from sampling or study design. Clin Trans Sci 2014; Volume #: 1-5

Keywords: big data, research methods, bias, sampling

In preparation for the 1936 presidential election, the biggest public opinion poll in history of the United States was conducted. More than 2.4 million respondents indicated whether they intended to vote for governor Alfred Landon of Kansas or the incumbent president Franklin Delano Roosevelt. The poll results were clear and unambiguous. Landon would win by a landslide. Presidential elections provide one of the few opportunities to validate public opinion polls against verifiable outcomes. In the 1936 election the large sample size poll was wrong. Roosevelt won 46 of the then 48 states. Landon carried only Vermont and Maine, and because these states were small, he received only 8 electoral votes.1

With a sample size so large, how could the study have gone so wrong? The survey was conducted by a magazine known as the Literary Digest. The group surveyed its own readers and Literary Digest readership was skewed toward those subgroups who supported Landon, including registered automobile owners and telephone subscribers. The same year, a poll by the American Institute of Public Opinion used a sample size only 2% of the size of the Literary Digest poll and predicted the outcome of the election within 1% of the actual result. In fact, the popular vote in American elections can be accurately predicted with sample sizes as small as 1,500 or about 0.0006 the size of the sample in the Literary Digest poll. Several polls with sample sizes less than 1,000 were very accurate in predicting the result of the 2012 presidential election (available at wikipedia.org/wiki/Nationwide_opinion_polling_for_the_United_States_presidential_election,_2012).

Although large sample sizes and "big data" have a number of strengths, studies can be of relatively little value if the large sample size is not representative of the population to which the results will be generalized or is missing a key information, especially on a nonrandom basis. The Literary Digest example shows how sample nonrepresentativeness does not assure that large samples produce better results. The enthusiasm for "big data" encourages the use of ever‐larger datasets with massive numbers of measured variables. "Big data" generally refers to "datasets with sizes beyond the ability of commonly used software tools to capture, curate, manage, and process the data within a tolerable elapsed time."1 Big data are clearly an important new direction for most areas of science as exemplified by the new National Institutes of Health initiative to transform big data into new knowledge (BD2K).2 The goal of the BD2K initiative is to "capture the opportunities and challenges facing all biomedical researchers in accessing, managing, analyzing, and integrating datasets of diverse data types (e.g., imaging, phenotypic, molecular [including various "-omics"], exposure, health, behavioral) and many other types of biological, and biomedical and behavioral data that are increasingly larger, more diverse, and more complex, and that exceed the abilities of currently used approaches to manage and analyze effectively." (See more at: http://bd2k.nih.gov/about_bd2k.html#bigdata). Certainly large datasets bring many advantages. They can be used to study rare events, and the integration of research protocols might greatly reduce the cost of investigation and the time required to evaluate research questions.3 Although we share the enthusiasm for big data, investigators will surely have less intimate knowledge about the texture and often the quality of the many elements in their datasets. The purpose of this paper is to offer a cautionary perspective on the potential for serious bias in studies using very large sample sizes and large numbers of outcome measures, and to provide suggestions for maximizing interpretability of these studies. Our comments focus on one assumption that underlies much of the enthusiasm for big data: the assumption that large sample sizes yield more meaningful results than small sample sizes.

Big Data, Electronic Health Records, and the Future of Epidemiologic Research

The current enthusiasm about electronic health records (EHRs) exemplifies why these issues of potential bias needs to be understood.4 Many investigators believe that the future of epidemiologic research will use information obtained from patients in community settings and recorded in EHRs. The proposal to build an EHR based on National Patient‐Centered Clinical Research Network (PCORnet)4 has been greeted with great enthusiasm. However, there can be systematic biases in the sample of people in EHR systems and there are often biases in the way information is obtained and recorded.3, 5 If we ignore these biases and assume they will be resolved through sheer sample size, we compromise the utility of the findings from our research. Here are a few of the biases that can be expected if we overemphasize sample size in relation to other aspects of study design.

Sampling bias

A substantial portion of the US population remains uninsured and even a larger group uses healthcare rarely only. Although the trend is toward greater use of EHRs, only about 40% of patients currently have their information recorded in EHRs. Population scientists have offered countless examples of the consequences of sampling bias. For instance, the large Nurses Health Study followed 48,470 postmenopausal women, 30-63 years of age for 10 years (337,854 person‐years). The study concluded that use of hormone replacement therapy cut the rate of serious coronary heart disease nearly in half.6 Despite the enormous sample size, the study failed to recognize the atypical nature of the sample and the confounding of estrogen therapy use with other positive health habits. The clinical trial portion of the Women's Health Initiative (WHI) was able to control for self‐selection and suggested that estrogen replacement did not lower the risk of heart disease and may actually be harmful.7 Later, investigators were able to show that the results of the Nurses Health Study do map to the WHI if the focus is on new hormone replacement users.8 Observational studies can provide valuable causal information, but only when the investigators have the right model. When the underlying sampling model is wrong, large sample size can magnify the bias.

Big Data and the Future of Health Services Research

Big data are likely to revolutionize health services research.9 But, despite the advantages of EHRs, the actual rollout in the United States is creating its own set of biases. For example, extensive customization of EHRs now makes it very difficult to combine data across systems. There are also serious problems with intraoperability, or compartmentalization of data across systems that often do not communicate with each other.10 Patients often change providers and may move from one EHR or insurance claims system to another, and as a result their trajectories are hard to follow. Changes in coding conventions and the frequent conversion of numerical data to text may result in information that cannot be easily tracked over time. Merging data can be challenging, particularly when the observations are stored in different proprietary systems that cannot be easily accessed.

Overhage and Overhage describe EHR data as a "cartoon" of the patient they are derived from. Claims forms are often incomplete and known to contain substantial errors. Some of these errors are intentional. For example upcoding or use of specific diagnostic codes is a common source of systematic error. Claims data often have missing observations, or a "Swiss cheese" quality.5 In addition to inaccuracy, observations from claims are often transformed in ways that obscure their original meaning.10 For example, a patient may be coded as having hypertension based on blood pressure readings or, alternatively, because she takes a medication commonly prescribed for high blood pressure.5 These problems may be more likely in big studies in which the investigators are not involved in the original data collection.

Ascertainment bias

Even for those captured by EHRs, there are serious problems with the sampling of health system encounters because many people see a physician as a result of a health event. Event driven visitation creates a serious bias toward the overestimation of illness and disability. A bias in the other direction can occur when the most health conscious people visit their providers more often than less health conscious peers in the community. In planned prospective research, follow‐up is typically achieved on a fixed interval. Sometimes these follow‐ups occur on a random basis. The analysis strategies use either fixed effects designed for assessment at defined intervals, or random effects models that assume follow is on a random time schedule. However, event driven follow‐ups violate the assumptions of both the fixed effects and the random effects models because follow‐up schedules are neither on a planned nor a random schedule.

Big Data and the Study of Health Determinants

As with any type of data, the data in EHRs are only as good as the information captured by the systems. For example, several analyses have concluded that more than half of the variance in health outcomes is driven by behavioral, environmental, and social factors while medical care explains only about 10%.11 Yet, social and behavioral factors are rarely recorded in the EHR. For example, regular consumption of fruits and vegetables is considered central to cancer prevention, but almost never recorded in the EHR.12 When behavioral and environmental data are recorded they are rarely captured in a uniform way.13 As a result, there is a tendency to estimate determinants of health outcome based on the variables that are included in the record. To use the tired analogy, investigators are "looking for the keys under the lamp post." Another problem is that missing data in EHRs are the rule rather than the exception. Especially problematic is that when data are missing, they are rarely missing at random. Even in very large studies, conclusions can be inaccurate because the most important variables are either not measured or are measured in different ways, with error, or are not included in the analysis model.

Measurement error

For any measured variable, the difference between the true score and the observed score results from measurement error. This error is common in all biological and behavioral sciences, but it can be controlled through systematic measure development. Small controlled studies often devote great attention to measurement precision. In contrast, users of big datasets may be unaware of how study variables were measured and low reliability of some measures can be expected. This can be a serious problem because it reduces the chances of finding significant relationships among measures. Thus, estimates of correlations and effect sizes are attenuated by measurement error. Large sample size may help reduce this bias, but if the measures are of very low reliability, the analysis will be focused on random variation. For example suppose two variables in a big dataset have reliability coefficients of 0.050 and 0.30. Even if these two variables were perfectly correlated in the real world ( r = 1.0), the maximum expected observed correlation would be only 0.38. A modest correlation would be unlikely to be detected, even in a very large datasets.

Internal versus External Validity: To Whom and What Do We Wish to Generalize?

One of the most important challenges is obtaining data in circumstances that are representative of settings in which healthcare is practiced. Green and colleagues described one of the major problems in the generalization from randomized clinical trials.14 Considering a population of 1,000 people, about 800 experience symptoms over an interval of 1 month. Among these an estimated 327 consider seeking medical care. About 217 will get care in a physician's office. Even among those seeking physician care, only about 113 will get care from a primary care provider. About 65 of the 1,000 will go to an alternative care provider. Only 21 of the 1,000 will visit a hospital or an outpatient clinic and 13 will go to an emergency department. Among the entire population only eight will be hospitalized and less than one will be hospitalized in an academic medical center.

Even though only one in each thousand are hospitalized in an academic medical center, much of the research published in our major medical journals is based on referrals and data from patients who received care in academic settings. This raises serious questions about the generalizability of many of our large randomized trials. Even when recruiting through practice‐based research networks, we only get access to less than 1/3 of the members of the general population. Most "Big Data" approaches that depend on EHRs only get data from the 217 patients who get to a physician's office. Even with big data, the focus is on the 21% who would be available for analysis. And if the 21% are a skewed sample, efforts to generalize will be compromised.

Big Data and the Randomized Clinical Trial

Randomized clinical trials do an excellent job of reducing biases internal to studies. However, randomization does little to assure that the results of the trial generalize to populations that may differ from the trial participants. It is common for therapeutic agents to look promising in phase 2 clinical trials, but to fail in larger phase 3 trials that are based on more representative study populations. Large samples in phase 2 trials may not address the problem, particularly if study participants are not selected at random from or representative of the population to which the results will be applied. Although cluster randomized trials help address this issue, they come with another set of limitations. Observations from a variety of disciplines suggest that the effects of interventions systematically decrease over time.11 In addition, the effects of interventions are expected to decrease as populations become more heterogeneous and complex, a phenomenon referred to as "voltage drop."15

Multiple comparisons bias

Replication of study results has become a challenging problem for contemporary science.16 Fraud is rarely the explanation for the nonreproducibility of results. One of the most important factors is that investigators have too many degrees of freedom when analyzing outcomes. For example, if 100 outcome variables are available for analysis, we would expect significant statistical effects for about five variables by chance alone. When big datasets include thousands of outcome variables and modern software is capable of examining all of these potential outcomes, the urge to attend to those that are statistically significant becomes irresistible.

The multiple comparisons problem in analysis of big datasets emerges in many different areas of biomedical science. The term "voodoo" has been used to describe the relationships between emotions and activity captured by functional magnetic resonance imaging (fMRI).17 Activity in fMRI might take advantage of thousands of potential response patterns and more than half of the published papers fail to make a meaningful adjustment for this problem.17 An independent review of 100 brain imaging papers in the top five journals similarly found that 40% of the papers did not correctly adjust for multiple comparisons.18 In studies of tumor biology, the title of a recent paper tells the whole story: "Almost all articles on cancer prognostics markers report statistically significant results."19 Incorrect conclusions from studies on tumor biomarkers result not only from multiple comparisons problems, but also because "predictions" actually come from retrospective rather than prospective observations.20 Some high quality EHR studies do adjust for multiple comparisons.21 However, unlike clinical trials, primary outcome variables are rarely declared prospectively in observational studies. Prospective declaration of primary outcome variables eliminates the possibility of selecting a significant outcome from among many variables. One recent analysis from the Amgen Pharmaceutical company suggested that promising preclinical trial results were replicated in only 11% of the tests.22 One of the reasons preclinical studies are so difficult to repeat is that the replications focus on a single outcome. However, unreliability of information can be found in the most basic lines of research. For example, mammalian cell lines are often cross‐contaminated. An investigator may purchase mouse cells but later learn that they are using guinea pig cells. Investigators studying ovarian cancer cells have later learned that they were really using breast cancer cells. Investigations of major cell repositories suggest that 14‐30% of cell lines are misidentified.23 Increasing sample size is not the remedy for this basic specification problem.

Big data studies can identify significant but inconsequential effects

Imagine that two randomized clinical trials compared new treatments for pneumonia. Both trials produce statistically significant results at exactly p = 0.05. One trial was based on 150 patients randomized in one of the two groups. The second trial was based on 15,000 patients randomized into two groups. Which treatment should be preferred? Many people would prefer the treatment based on the larger trial. However, the effect size for the smaller trial would need to be significantly larger in order to achieve the same p = 0.05 significance level. At a constant p level, effect size declines as a function of sample size.24 In other words, the number needed to treat would be considerably smaller for the treatment evaluated in the small trial. Although large trials have many advantages, marginally significant effects observed in large trials typically mean that the effect of the treatment is quite modest. At a constant exact p level, an individual patient would be more likely to benefit from a treatment evaluated in a small trial. Treatment effects identified in big datasets, although statistically significant, might be almost trivial at the individual level as statistical significance testing is designed for use in small rather than enormous datasets. Figure 1 shows the effect size in two hypothetical trials, each with a difference of p = 0.05. The effect size of the small trial is much more meaningful for the individual patient.

Current practice in trials versus big data

Contemporary clinical trials are required to register in Clinicaltrials.gov. When trials are prospectively registered, the investigators are required to declare their primary and secondary outcome variables well in advance of data collection. As a result, they have fewer opportunities to report on other variables that turned out to support the value of their treatments. Analysts of big data are usually not restricted to just one or two variables and, as a result, their conclusions are often more conservative. On the other hand, there may be other unexpected consequences of using multiple outcome variables. For example, if studies are registered prospectively, statisticians are likely to request adjustments for multiple comparisons. If analysts do adjust for the hundreds of tests, it is likely that many potentially true effects will be overlooked.

Table 1 summarizes the potential biases, questions that should be asked when considering using large datasets, and some potential practices that might be used to minimize the bias. Despite the enthusiasm for basing a new epidemiologic science on "big data" repositories, we urge caution in uncritically accepting the interpretation of these analyses. Our statistical methodologies were developed for inferences about small datasets and are often irrelevant or inappropriate for the analysis of big data. Further, there are many occasions in which carefully done small studies can provide a more reliable answer at a lower cost. Newly emerging big datasets offer promise to answer questions not previously possible. However, we urge users, purchasers, and researchers to be aware of the potential biases outlined above, to ask questions and use procedures such as those in Table 1, and to work to enhance the quality of datasets, analyses, and conclusions.

Table 1

Potential biases

Questions to ask

Potential practices to minimize problem

The Potential of Big Data

We do not want to leave the reader with the impression that big data has no place in biomedical research. Investigators will come to master the biases and new methodologies are likely to revolutionize several different areas of research. For example identification of rare medication side effects or observation of outcomes among people with rare diseases will benefit greatly from big data methodologies. We only caution that information can mislead when not acquired systematically.

Conclusion

In biomedical research, as in other endeavors, we often assume that bigger is better. There are many circumstances in which very large studies include systematic biases or have large amounts of missing information, and even missing key variables. Large sample size does not overcome these problems: in fact, large sample studies can magnify biases resulting from other study design problems. Unlike the public opinion poll for the 1936 presidential election, it often is difficult to validate the results of many biomedical studies with clearly observed public events. We suggest that, in the near term, big data and large sample size alone is unlikely to improve the validity of most studies in epidemiology, health services research, determinants of health, or clinical trials.

We often assume that large sample size is the remedy to inferential bias.25 For many inferences, representativeness is more important than sample size. Bigger is not necessarily better. The examples used in this commentary are based on large versus small sample sizes in contemporary research investigation. These examples represent the small data era. The problems we describe are likely to be much more severe in the new era of big data when investigators are more likely to be separated from the data collection process. Clearly the analysis of large databases will be an important part of our future, especially if combined with other data sources, with purposeful attention to the issues above, and with appropriate sensitivity analyses to address potential biases.

Notes

The views expressed in this paper are those of the authors and do not reflect the positions of the National Institutes of Health, the National Institute of Mental Health.

References

1. Freedman D, Pisani R, Purves R. Statistics. 4th edn. New York: WW Norton; 2004. [ Google Scholar]

12. Council NR. Capturing Social and Behavioral Domains in Electronic Health Records: Phase 1. Washington, DC: The National Academies Press; 2014. [ Google Scholar]

20. Vermorken J. Annals of Oncology: a statement of editorial intent. Ann Oncol. 2012; 23: 1931-1932. [ Google Scholar]

24. Greenwald AG, Gonzalez R, Harris RJ, Guthrie D. Effect sizes and [ p values: what should be reported and what should be replicated? Psychophysiology. 1996; 33: 175-183. [ PubMed] Google Scholar]

Articles from Clinical and Translational Science are provided here courtesy of Wiley-Blackwell

# data[].attributes.attachment_link.title
Big Data and Large Sample Size: A Cautionary Note on the Potential for Bias

# data[].attributes.attachment_link.description
A number of commentaries have suggested that large studies are more reliable than smaller studies and there is a growing interest in the analysis of "big data" that integrates information from many thousands of persons and/or different ...

# data[].attributes.body
This week we learned about mobile and consumer informatics and discussed gamification. Here are my takeaways from our discussions.

1. Having the proper tools for a target audience is necessary for engagement  and data collection.

2. Collecting massive amounts of data can have its pros and cons. Pros include, data being collected at a faster rate, in turn, resulting faster. Cons include, more room for error and bias.

# data[].attributes.attachment_link.readable_text
Screening and Diagnostics Breast Cancer Imaging Routine Screenings

Featured Expert:

Telemedicine, which enables video or phone appointments between a patient and their health care practitioner, benefits both health and convenience. More health care providers are offering to "see" patients by computer and smartphone.

"Health organizations are providing virtual appointments and are expanding their telehealth options, particularly in light of the COVID-19 pandemic," says Brian Hasselfeld, M.D. Hasselfeld is assistant medical director for digital health innovations at Johns Hopkins Medicine.

Improved technology has made telemedicine easier, even for those who don't consider themselves computer savvy. Patients can use telemedicine through the MyChart online platform or mobile app, and request a virtual visit with many Johns Hopkins doctors, practitioners and therapists.

Telemedicine, also known as telehealth, offers many advantages, including:

Comfort and Convenience

With telemedicine, you don't have to drive to the doctor's office or clinic, park, walk or sit in a waiting room when you're sick. You can see your doctor from the comfort of your own bed or sofa. Virtual visits can be easier to fit into your busy schedule. With telemedicine, depending on your schedule, you may not even have to take leave time from work or arrange for child care.

What to Expect During Your Cardiology Telemedicine Visit

Control of Infectious Illness

To help prevent the spread of COVID-19, flu and other infectious diseases, doctors can use telehealth appointments to prescreen patients for possible infectious disease. It also saves sick people from having to come in to the office. Less exposure to other people's germs helps everyone, especially those who are chronically ill, pregnant, elderly or immunocompromised.

Better Assessment

Telemedicine can give some specialty practitioners an advantage because they can see you in your home environment. For example, allergists may be able to identify clues in your surroundings that cause allergies. Neurologists and physical and occupational therapists can observe you and assess your ability to navigate and take care of yourself in your home. Telemedicine is also a good way to get mental health assessment and counseling.

Family Connections

When consulting with your doctor, it's always good to have a family member who can help you provide information, ask questions and take note of your doctor's answers. If that person lives out of town, or even across the country, telemedicine can loop your family member in on the virtual visit if you authorize it.

Primary Care and Chronic Condition Management

Regular visits with primary care practitioners such as those specializing in family medicine, internal medicine and pediatrics, are essential to your family's health. Telemedicine makes it easy to connect with a doctor or nurse practitioner. Some systems are set up so that new patients can get an appointment with the next available practitioner, which can save time.

Using Telemedicine to Connect to Your Johns Hopkins Doctor and Care Provider

# data[].attributes.attachment_link.description
Telehealth, also called telemedicine, offers real advantages to patients. It's easier than ever to meet with your doctor online for routine visits, even if you're not computer savvy. Learn more about what virtual visits can do for you.

# data[].attributes.body
This week we learned about Telehealth! Here are my takeaways!

1. Telehealth has been an amazing addition to the world of healthcare that makes patient care more accessible and at the touch of a button.

2. Telehealth has tons of programs that can help patients stay out of the hospital as well as help them know when emergency services are necessary. Medtronic is the implementation of having a blood pressure machine available in a patient's home so patients can take their blood pressure and report it to the provider without having to come into the office to have it checked. Telestroke is a program where a neurologist can provide services through a video to assess for stroke symptoms and help manage stroke symptoms to minimize the risk of symptoms worsening before getting to the hospital.

# data[].attributes.body
This week we learned about the exchange of health information and data sets. Here are my takeaways.

1. The MassHIway is the Massachusetts health information exchange for patient information across the entire healthcare community in Massachusetts. The statewide ENS framework can alert providers of patient admissions, discharges, and transfers to other hospitals, ERs and post-acute care facilities. Through this framework and services, the Mass HIway allows for seamless health information exchange in Massachusetts in order to delay care and treatment as little as possible.

2. Datasets can be important in identifying disparities in a disease such as abnormalities in ovarian cancer. Without the collection of data, discovering what connections there may be between a contributing factor and disease would seize to exist.

# data[].attributes.headline
From paper to electronic health records...

# data[].attributes.subject
From paper to electronic health records...

# data[].attributes.body
This week we learned about electronic health records and their importance. Here are my takeaways.

1. Electronic health records are vital in healthcare settings to allow for efficiency and easy access to a patients record. Having health records electronically rather than on paper also allow for easier access and communication between nurses, providers and across hospital groups if needed.

2. Electronic health records plays a big role in minimizing the amount of mistakes such as documenting on the wrong patient or giving the wrong medication. With the help of technology, making an error can be difficult with tons of flags or pop-ups stopping someone from making a mistake that could turn bad!

# data[].attributes.body
This week we learned about meaningful use. Here are my takeaways.

1. Meaningful use has made great strides in the world of healthcare, however does not always equate to the millions of dollars thrown into quality improvement.

2. If the money spent and the strides made do not continue to match up, I can see meaningful use slipping away. However, if we can find a way to be financially efficient while also implementing meaningful use, we can continue to make bigger and better strides while also being financially efficient.

# data[].attributes.body
This week, we learned about the DIKW hierarchy. These are my takeaways.

1. The DIKW hierarchy is the basis of healthcare. Without the collection of data, we dont have the information we need to move forward with patient treatment. Without the knowledge and wisdom, integration of what we know, we dont know the treatments needed for the given data. It all connects.

2. The implementation of many systems in healthcare settings, follow the DIKW hierarchy as it is a clear guide that leads to confidence of use from staff and increased integration on new models and systems.

# data[].attributes.attachment_link.title
MyChart - Epic's Patient to Provider Portal

# data[].attributes.body
This week, we learned about big data! One takeaway I had was that big data can make positive and negative impacts. I focused my discussion around the use of MyChart and while it is a positive that we have access to our medical records at the tips of our fingers, the negative impact is that we receive information before our doctor does and tend to begin to interpret the information before the doctor even sees it leading to frustrations and confusion. Another takeaway I had is how innovative big data is. It was interesting to see how big data was already implemented in my life prior to really knowing about it. As we continue on in the course, I am realizing more that the world of informatics is everywhere and we are slowly learning of all the places it has existed this entire time!

# data[].attributes.body
In my discussion post, I talked about MyChart, a patient portal that is accessible to patients at any point in time. As a patient who uses MyChart, I have found it extremely helpful for making appointments, viewing test results and obtaining vaccine information, especially for school! MyChart is a great system that using interoperability in healthcare.

# data[].attributes.headline
Tiger Summit (2006) - The 10 Year Vision

# data[].attributes.subject
Tiger Summit (2006) - The 10 Year Vision

# data[].attributes.body
https://nursekey.com/the-evolution-of-the-tiger-initiative/

# data[].attributes.headline
Revolutionizing Health Informatics - The Tiger Initiative 

# data[].attributes.subject
Revolutionizing Health Informatics - The Tiger Initiative 

# data[].attributes.attachment_link.title
Inside a Movement to Revolutionize Health Informatics Education

# data[].attributes.attachment_link.readable_text
A year ago, more than one hundred nursing leaders representing seventy organizations met to define a unified, collective vision for the future, one that bridges the quality chasm using information technology. On November 1, 2006, the Technology Informatics Guiding Education Reform (TIGER) Summit participants defined action steps that the nursing profession can take to better prepare our nursing workforce to use technology and informatics with the goal of improving the delivery of patient care. Today a practicing nurse's portfolio of necessary skills includes computer literacy, information literacy, and informatics skills. The TIGER Initiative is focused on helping the nursing profession to adopt informatics tools, principles, theories, and practices that make healthcare safer and more effective, efficient, patient-centered, and equitable for all stakeholders. The executive summary report and recommendations from the TIGER Summit are available online at www.tigersummit.com.

While the TIGER Initiative started out as a grass-roots effort to engage all stakeholders who are committed to a common "vision" of an ideal electronic health record (EHR) for nursing practice, today more than 120 diverse organizations are joining this effort. While the original 70 organizations that attended the Summit work towards completing their strategic action plans, additional nursing professionals have joined the TIGER Initiative to collaborate on nine important topics. These nine topics include:

1. Standards and Interoperability

2. Healthcare Information Technology National Agenda/Policy

3. Informatics Competencies

4. Education and Faculty Development

5. Staff Development/Continuing Education

6. Usability/Clinical Application Design

7. Virtual Demonstration Center

8. Leadership Development

9. Consumer Empowerment/Personal Health Record

As of this writing, 280 nurses have volunteered their expertise to work on the nine collaborative teams.

Each collaborative team is lead by an industry expert on the specific topic. The goal of each collaborative team is to share their findings and recommendations with all practicing nurses and nursing students through targeted outreach activities. Examples of the materials that the collaborative teams are developing include presentations, white papers, webinars, and articles for publication in specialty journals and textbooks.

The diverse background of the nurses participating in this initiative is unparalleled. Participants represent the interests of nursing professional organizations, nursing informatics organizations, government agencies, information technology vendors, industry partners, non-profit organizations, healthcare provider organizations, and academic institutions. Together these teams are reaching out to gather case studies, examples of innovative practice and education models, publications, and ongoing research programs that represent a diversity of nursing professionals both in educational preparation and practice experiences. These teams are concurrently developing mechanisms to enhance collaboration between professional organizations, government and policy-making agencies, and industry partners to specifically address the educational needs of the nursing workforce so they can better use technology to improve the delivery of patient care.

Why are so many nursing leaders on board with the TIGER Initiative? There has never been a better opportunity for nursing to lead the effort to reform our healthcare delivery system using technology as the enabler and the bridge to do so. Technology is also the enabler facilitating the collaborative effort of these teams. These teams are meeting via web-enabled meetings, sharing documents via wikis and SharePoint®-enabled websites, and conducting audio conference calls that are recorded if not all team members can attend the meetings. The outcomes of each of the collaborative teams will be available for distribution through a variety of electronic and multi-media delivery mechanisms. The collaborative teams have already established their topic-specific goals and are organizing smaller work groups to accelerate the achievement of their outcomes. It is not too late to roll up your sleeves and joint this effort! Instructions are provided after each collaborative team description. If you have feedback or questions related to the TIGER Initiative and/or the ways in which you can become an active proponent of this program, please contact the Program Director, Donna DuLong, at the email address below.

Author

Donna DuLong, RN, BSN
Email: donna@tigersummit.com

Donna DuLong is the Program Director of the Technology Informatics Guiding Education Reform (TIGER) Initiative. Donna has worked in the healthcare information technology industry for 17 years, focusing primarily on nursing-based, information-technology solutions related to patient safety, medication management, and evidence-based knowledge. At the TIGER Initiative, Donna coordinates the efforts of the nine collaborative teams and the participating organizations towards achieving the three-year action plan that was defined at the TIGER Summit. Donna has held several executive management positions in the healthcare information technology market with responsibilities for business development, product development and management, marketing, compliance, implementation, and customer support. Donna has worked with numerous Health Information Systems vendors including Thomson Healthcare, HBOC/McKesson, Pyxis Corporation, Multum Information Services, Cerner, Bridge Medical, and Medvantx. Donna holds a baccalaureate degree in nursing from Michigan State University. She has completed graduate work in nursing and business at the University of San Diego, and has worked for seven years in critical care nursing.

# data[].attributes.attachment_link.title
Informatics: The Tiger Project | OJIN: The Online Journal of Issues in Nursing

# data[].attributes.attachment_link.description
A year ago, more than one hundred nursing leaders representing seventy organizations met to define a unified, collective vision for the future, one that bridges the quality chasm using information technology. On November 1, 2006, the Technology Informatics Guiding Education Reform (TIGER) Summit par…

# data[].attributes.body
Going into week 2, I enjoyed learning about the TIGER initiative and the 7 steps. One takeaway from this was the realization of how relatable these 7 steps already are. I was able to connect to personal experiences in my practice to mostly all of them! Another takeaway I had was how easy lots of the steps are to implement and furthermore, how changing they can be to the way we practice when implemented. When reading through my peers' posts, I noticed that many of us made the connection of quality care and enhancing patient care. It is clear that we have had a positive experience with the use of the 7 steps without even realizing we were implementing them!

# data[].attributes.body
Here is a great video that explains health informatics through drawings!

# data[].attributes.attachment_link.authors[].name
George Mason University College of Public Health

# data[].attributes.body
Here is a great article published in 2023 that really breaks down healthcare informatics and how it is used!

# data[].attributes.attachment_link.readable_text
Definition/Introduction

Health informatics is the interprofessional field that studies and pursues the effective uses of biomedical data, information, and knowledge for scientific inquiry, problem-solving, decision making, motivated by efforts to improve human health. In other words, it is the science of information where the information is defined as data with meaning.

For the healthcare practitioner, the subspecialty of clinical informatics is most relevant. Clinical Informatics is an interprofessional practice that blends medical practice with information technologies and behavioral management principles. Rather than a rigid academic or technical pursuit, clinical informatics is a practical discipline that improves patient outcomes, advances medical research, and increases the value of healthcare delivery. The key to these goals is the understanding that the successful evolution of health care is determined not by technical capability, but by how effectively the technology is designed and integrated into existing cultures, regulatory frameworks, and institutional workflows.

Though clinical informatics has been practiced since the 1950s, it was not until the internet era that the discipline began achieving widespread consideration and application outside academics. In the United States, clinical informatics was driven further into the spotlight as new federal laws (see below) strongly incentivized the adoption of new healthcare information technology systems, citing these systems as solutions to the nation's soaring health care costs and chronic disease rates. [1][2][3]

Issues of Concern

Applications

As a practical discipline, clinical informatics has far-reaching applications within the healthcare framework-individual physicians, multi-center hospital systems, medical insurance firms, government agencies, medical device developers and more are all potential beneficiaries. Examples include:

Electronic Health Record (EHR): Perhaps the most publicly high-profile application of clinical informatics is the universal adoption of the EHR. The Affordable Care Act of 2009 (see below) mandated that all healthcare institutions transition from paper to exclusively digital medical record system. Since it must record every patient encounter, medication ordered, and laboratory test performed, the EHR impacts every aspect of a healthcare institution's operations. Subsequent EHR adoption achieved varied results. Successful institutions integrated the new EHR systems with existing institutional culture and workflows with minimal disruption to or even improved delivery of healthcare services. Other institutions with less effective or absent clinical informatics support saw worsened employee morale, decreased operational effectiveness, and compromised patient safety.

Predictive Medicine: One of the most promising potential applications of clinical informatics is the development of predictive medicine. Predictive medicine is the science of accurately risk-stratifying an individual for developing the disease within a specified time-frame. While predictive capabilities traditionally revolved around genetics (e.g. karyotype testing for Down Syndrome, BRCA gene testing for breast cancer), clinical informatics has helped to usher in a new era of predictive medicine based on so-called Big Data, huge quantities of data obtained from a variety of disparate sources in real-time. Predictive tools based on big data has the potential to help clinicians better predict who will get sick when and how best to intervene before the patient becomes sick. Though healthcare has yet to develop its own predictive tools, Target Corporation, a major retailer, has already developed a big-data informatics system that predicts when a customer is pregnant; the company subsequently tailors its marketing efforts towards those customers accordingly.

Epidemic Tracking: Not limited to healthcare data, clinical informaticists can assist in capturing and transforming any data source into usable information. In 2014, public health specialists published a report demonstrating how they could track and predict HIV outbreaks based on real-time data captured from the social media platform, Twitter. Prior research demonstrated how Twitter could also be used to predict outbreaks of influenza. With the measles and Ebola crises of 2015, other groups are now attempting to apply clinical informatics principles to capture non-traditional streams of data and create systems of predicting and preventing the next epidemics.

Legislation

Executive Order 13335 (2004): Executive Order 13335, also known as the Incentives for the Use of Health Information Technology and Establishing the Position of the National Health Information Technology Coordinator, created the Office of the National Coordinator of Health Information Technology (ONC). While this did not directly affect clinical informatics or healthcare at large, it was the United States Federal Government's first step in creating a nationwide health information exchange, a foundational system for collecting and exchanging data across hospitals, regions, and states. To date, a national healthcare information exchange nor standards for creating one has not yet been established.

The HITECH Act (2009): The Health Information Technology for Economic and Clinical Health (HITECH) Act passed by Congress as part of the American Recovery and Reinvestment Act of 2009 catalyzed industry adoption of clinical informatics with a goal of "Improving Health Care Quality, Safety, and Efficiency." Through a system of payments and penalties, the HITECH Act strongly incentivizes not only adopting the EHR but also achieving "Meaningful Use," a set of requirements that demonstrate effective integration and use of the EHR within the healthcare institution. The HITECH Act further strengthened patient information privacy standards for the new era of digitized and highly transferable information.

Governing and Professional Institutions

International Medical Informatics Association (IMIA): Founded in 1987, IMIA is the foremost international coordinating body for the promotion and development of medically-related informatics interests including biomedical informatics and clinical informatics. It serves as the hub that coordinates the efforts and goals of regional subsidiary institutions worldwide.

American Medical Informatics Association (AMIA): AMIA is the United States affiliate institution of its IMIA parent organization. Though officially the United States representative organization, AMIA is composed of thousands of members from over 40 countries worldwide. AMIA's goal, like IMIA's, is to promote and develop the role of informatics in improving patient care, healthcare operations, and biomedical research.

American Board of Medical Specialties (ABMS): The ABMS is the certifying body regulating and overseeing all physicians and physician specialists, including physician clinical informaticists. In 2011, ABMS officially recognized clinical informatics as a subspecialty of medicine and began offering board certification to qualifying physicians in 2013 through the American Board of Preventative Medicine.

Other Informatics Subspecialties:

Ontology:

A framework for representing knowledge (e.g., SNOMED CT).

Taxonomy:

Is the practice and science of classification. It adds structure to the information to make it easy to search and filter.

The core concern of an informatician is transforming data into information into knowledge.

Data (Pleural datum): observations (characters, symbols, signs) that may or may not be meaningful.

Information: data that has meaning or facts from which conclusion can be drawn. Data has a structure or relationship.

Knowledge: information believed to be justifiably true. Processed information for a purpose.

Wisdom: Knowledge over time

Informatics Fields

A number of highly subspecialized areas of informatics have developed. Some examples include the following:

Internet Informatics: The study of technologies behind internet-based information systems and skills needed to map problems to deployable internet-based solutions.

Data Mining & Information Analysis: Integrates the collection, analysis, and visualization of complex data and its critical role in research, business, and government.

Life Science Informatics: Examines artificial information systems, which help scientists make great progress in identifying core components of organisms and ecosystems.

Social Computing: Studies social interaction and developing systems that act as introducers, recommenders, coordinators, and record-keepers.

Human-Computer Interaction: Informatics that studies how design and development work impacts users.

Information Architecture: Information architecture studies the development of successful Web sites, software, intranets, and online communities. Architects structure the information and its presentation in a logical and intuitive way so that information can be successfully used.

Information Assurance and Cybersecurity: The practice of creating and managing safe and secure systems. It is crucial for organizations public and private, large and small. Organizational informatics:

Organizational informatics is fundamentally interested in the application of information, information systems and information and communications technology within organizations of various forms including the private sector, public sector, and voluntary sector organizations. [4][5][6][7]

Clinical Significance

Informatics involves the practice of information processing and the engineering of information systems. The field considers the interaction between humans and information. Informatics has a social impact on information technologies.

Medical informatics can be an important tool to control and address public health concerns using an interprofessional team of physicians, nurses, pharmacists, and public health workers. Some examples include patients missing immunizations or tracking the proper use of controlled substances. The future of medical informatics is promising and many healthcare professionals should have a background in informatics. (Level V)[8]

# data[].attributes.attachment_link.description
Health informatics is the interprofessional field that studies and pursues the effective uses of biomedical data, information, and knowledge for scientific inquiry, problem-solving, decision making, motivated by efforts to improve human health. In other words, it is the science of information where the information is defined as data with meaning.

# data[].attributes.body
This week was a great introduction to informatics. Prior to this week, I never had really heard of informatics but after completing week one, I find myself having a slightly better understanding of what I will be learning!

Healthcare Informatics
"the interprofessional field that studies and pursues the effective uses of biomedical data, information, and knowledge for scientific injury, problem-solving, decision making, motivated by efforts to improve human health." - National Library of Medicine

While watching the required videos, I learned that healthcare informatics is all around us and seen much more often than we think as nursing students. As we go through the semester, I am excited to dive deeper into the world of healthcare informatics and begin to apply it more in my clinical setting and in my future career as an RN and NP!