Follow up on Strengthening Health information infrastructure

1. Follow up on Strengthening Health information infrastructure HCQI Expert Group, 16 November 2012 Jillian.Oderkirk@oecd.org Niek.Klazinga@oecd.org Elettra.Ronchi@oecd.org

2. Agenda to improve health information infrastructure • The 2010 Health Ministerial Communiqué noted that health care quality improvement requires more effective use of data that has been already collected • Strong information infrastructure requires • Data about real people in “real world settings” • Individual-level data and often the linkage of data across two or more different databases • Protection of data privacy in the collection and use of personal health data

3. OECD health information infrastructure projects 2011-12 • Electronic health record system development and its potential use to monitor health care quality and system performance • Health and health care monitoring and research using personal health data and the protection of information privacy • Joint consultation with the OECD Working Party on Information Security and Privacy about privacy protection challenges in the use of personal health data

4. 1. Electronic Health RECORD System DEVELOPMENT and ITS POTENTIAL USE TO MONITOR HEALTH CARE QUALITY KEY FINDINGS

5. Desired qualities of an EHR system Desired qualities of EHR system records include: • Accuracy, completeness, comprehensiveness, reliability, relevance, timeliness and accessibility If these desired qualities are reached… • EHR systems could support monitoring and conducting research on the health of populations and the quality, safety and efficiency of health care • Evaluation of the suitability of EHR systems to support statistical uses can not wait – as decisions taken today may either facilitate or obstruct statistical uses

6. 25 countries participated in an HCQI survey that found: • National plans to implement EHRs (22) • Includes data use for monitoring/research (18) • National governing bodies responsible for national clinical terminology and interoperability standards (18) • Implementation started (20) • Minimum data sets defined (18) • Use clinical terminology standards for key elements in all records (ex. diagnosis (13)) • Databases for health care monitoring/research already developed from EHR records (12)

7. Views about the next 5 years Over the next 5 years: How likely is it your country will use any data from EHRs for national health care quality monitoring?

8. Barriers and facilitators Barriers Facilitators • Governance of EHR implementation and data use • National standards - clinical content and interoperability • Legal/regulatory requirements • Certification of vendors • Incentives/penalties • Evaluation of data usability • Auditing of clinical content • Legislative barriers • Data privacy/security concerns • Shortages of resources/skills • Lack of standards • Interoperability problems • Lack of unique identifiers • Data sharing • Reluctance among health professionals • Data quality

9. 3. SECONDARY USE OF PERSONAL HEALTH DATA TO MONITOR HEALTH, HEALTH CARE QUALITY AND HEALTH SYSTEM PERFORMANCE KEY FINDINGS

10. Fact finding • Survey of 20 countries on the use of personal health data to monitor health and health care quality to : • Understand the potential, the barriers and the best practices in the linkage of personal health data • Explore the privacy and data security environment • Found considerable cross-country variation – linked to differences in risk-management in balance of data access and data privacy

11. National information infrastructure appears strong • All reported hospital in-patient data; mortality data; population census or registry data; and survey data • All are collecting identifiable personal health data at a national level • All countries report using national health data to regularly monitor some aspects of health care quality • All countries report having legislation that speaks to the protection of personal information. • Many examples of the linkage of data to support health care quality and health system performance

12. Country variation

13. About half of countries monitor health care quality regularly via linkages

14. Sources of variation • Whether or not… • An exemption to patient consent requirements may be granted? • Authorities holding data needed for a project (data custodians) will share data with other government authorities? • It is clear with whom to request approval and what is the criteria to obtain approval? • There are mechanisms for privacy respectful access to data?

15. Concerns about the future • Failing to maintain current capacity to generate evidence due to the costs of project vetting, linkages, and data access services • Moving backward in the generation of evidence due to: • Increasingly strict interpretations of existing legislations • New legislations speaking to data privacy protection legislation due to EU reforms, ICTs, new projects

16. 4. Joint consultation of the OECD HEALTH CARE QUALITY INDICATORS Expert Group and the OECD Working Party on Information Security and Privacy

17. Joint dialogue with experts in data privacy • Members of the OECD Health Care Quality Indicators Expert Group met with members of the OECD Working Party on Information Security and Privacy on May 11, 2012 • To begin to achieve a common understanding of privacy protection challenges in the use of personal health data • To identify potential joint international actions

18. Conclusions The group recognised that:  • The implementation of OECD privacy guidelines in the field of health care has been heterogeneous across countries • Excess variability reduces access to complete data and undermines internationally comparable indicators • Privacy and health experts have trouble communicating with each other because they lack a common vocabulary

19. Recommendations Countries would benefit from an international effort to: • Categorize different forms of data and data uses according to their risks to data privacy • Provide a portfolio of best practices • Illustrate how best practices may be translated into local implementation • An on-going dialogue will be needed to provide direction regarding new forms of health data, e.g. ICTs

20. PROPOSED WORK PLAN FOR THE HCQI INFORMATION INFRASTRUCTURE PROJECT

21. Proposed work plan for 2013-15 On-going monitoring of the development of national information infrastructure • Bi-annual data collection – avoiding overlap • Report in the OECD Health at a Glance publication Health data privacy project • An international health data privacy lexicon providing common terms of reference for privacy and health experts • A taxonomy of risk in the usage of health data • Promising practices enabling secure access to each category of data.

22. Monitoring in 2013 • Personal health data and the use of these data for health and health care quality monitoring and research • Track progress since 2011

23. Monitoring in 2015 • Electronic health record systems and the use of these data for health care quality monitoring • Track progress since 2012 N.B. subject to approval in the 2015-16 PWB

24. Health data privacy lexicon • Privacy regulators, IT professionals, statisticians, health policy makers and researchers each have their own vocabulary for discussing data privacy • Some concepts are poorly defined • We need to communicate clearly to all stakeholders in decisions about the protection of data privacy • This requires that we develop clear and agreed-upon definitions • Work on a lexicon should proceed simultaneously with work on a taxonomy

25. Health data privacy taxonomy of risk Objective: Categorise types of data, data uses and data users in terms of risks Level: International (root level) Presentation: Excel workbook or database Benefits: • Support harmonisation of practices • Support multiple users and uses • Approval bodies, data custodians, researchers, privacy regulators • Country-specific level can be developed (national policies and practices)

26. Taxonomy of risk dimensions

27. Health data privacy taxonomy of risk • Promote consideration of both risks to individual privacy and to public health/good governance when decisions are taken

28. Promising practices in enabling use • Data with high risk to individual data privacy will require strong controls to mitigate risk • This project complements the taxonomy by describing controls that hold the highest promise for reducing risks to privacy including: • Data de-identification steps and methods • Participant consent methods • Access and data security controls

29. Evidence gathering Surveys and case study interviews will help us to learn more • About the decision rules/taxonomies that are used when projects are approved • About the data privacy protection practices that are currently used Experts interviewed for the 2011/12 HCQI information infrastructure studies would be key resources in addition to new experts to be identified by countries

30. Stakeholder engagement • Many stakeholders are involved in decision-making about health data and its uses • We propose identifying a small and focussed advisory panel to guide the project that includes multiple stakeholders • We propose sharing interim results with stakeholders and obtaining feedback Stakeholders: • Privacy regulators • Health data custodians • Research review boards • Health policy makers • Researchers • IT professionals • Patient groups

31. N.B. subject to approval in the 2015-16 PWB *N.B. subject to 2015-16 PWB

32. Members are invited to…. • Discuss the publication of the consolidated report (DELSA/HEA/HCQ(2012)11) • Discuss the proposal for future work to strengthen information infrastructure for health care quality • On-going monitoring • Personal health data (data linkages) in 2013 • Electronic health records in 2015 • Health data privacy project in 2013-15 • Lexicon • Taxonomy (risk categorisation) • Recommended practices