Medical specialty society and provider association registries need to ingest and process patient data as collected from their members to support analytics for quality improvement, federal reporting, and research to improve patient care and outcomes. The opportunities and benefits of data collection have been increasingly emphasized as AI applications create more demand for innovations driven by patient-centric data.
The collection of patient data, patient-related data such as device data, or any of their derivatives raises some privacy considerations which can be impactful for regulatory compliance, provider trust, and ultimately patient trust:
• Regulatory compliance: For US-based registries, typically Health Insurance Portability and Accountability Act (HIPAA) is of primary concern at the federal level. For some use cases, state-specific privacy regulations or international regulations like the European Union’s General Data Protection Regulation (GDPR) may also need to be taken into consideration. These regulations may have varying requirements for data handling, data sharing, patient consent, breach notification, and other privacy factors.
• Environmental constraints: Most regulations will set some requirements regarding the environment where patient data or its derivatives are stored. These may include privacy and security controls, like electronic and physical security, encryption standards, and access controls.
• Dataset identifiability: Regulations like HIPAA or the GDPR will reflect a sliding scale of identifiability. At one extreme, fully identifiable source data (including unambiguous direct identifiers, like names or source ID numbers) is very tightly controlled. As an intermediate step, a HIPAA Limited Data Set (LDS) or pseudonymous data under the GDPR will have direct identifiers removed, but will still be considered identifiable and thus remain under the scope of the regulation, with some attendant constraints. At the other extreme is data that is no longer considered identifiable or personal, that has been de-identified under HIPAA or anonymized under the GDPR.
For many privacy regulations, de-identifying or anonymizing a data set takes the data outside the scope of relevant privacy laws by making it non-personal. This usually leads to fewer operational constraints around the use of the now non-personal data. The reduction in constraints can reduce compliance burden, reduce data localization requirements, and remove data deletion requirements. Perhaps most importantly, de-identification and anonymization is often required for secondary uses of personal data, which are critical to getting value from applications like AI, predictive modeling, research, product development, and other analytics applications.
For provider organizations looking to do more with patient data and patient-derived data, data demands are increasing in multiple dimensions. Particularly for data-hungry AI applications, there is significant benefit to growing data assets in terms of:
• Data modalities, expanding to include unstructured text, medical images, and sometimes omics data.
• Data domains, expanding from clinical or EHR datasets most available to providers to also include mortality, social determinants of health, prescription, claims, device data, and other domains.
Multimodal and multi-domain data assets can add complexity to data acquisition. Multimodal data requires a more sophisticated de-identification/anonymization approach. Multi-domain data can require privacy-preserving tokenization and linkage, as well as careful program design to ensure linkage and resulting internal or external data releases are managed in a privacy-compliant manner.
Balancing regulatory requirements, technical design and implementation, data environment requirements, and identifiability assessments can be a significant challenge. Most organizations benefit from an up-front program design, ensuring alignment between legal, privacy, business, and IT teams to ensure the intended approach is a good fit for each team.
To learn more about IQVIA’s solutions for medical specialty societies and provider associations, contact us at ppa-contact@iqvia.com.