Regulatory Disruption and Arbitrage in Health-Care Data Protection.

This article explains how the structure of U.S. health-care data protection (specifically its sectoral and downstream properties) has led to a chronically uneven policy environment for different types of health-care data. It examines claims for health-care data protection exceptionalism and competing demands such as data liquidity. In conclusion, the article takes the position that healthcare- data exceptionalism remains a valid imperative and that even current concerns about data liquidity can be accommodated in an exceptional protective model. However, re-calibrating our protection of health-care data residing outside of the traditional health-care domain is challenging, currently even politically impossible. Notwithstanding, a hybrid model is envisioned with downstream HIPAA model remaining the dominant force within the health-care domain, but being supplemented by targeted upstream and point-of-use protections applying to health-care data in disrupted spaces.

BioSharing: curated and crowd-sourced metadata standards, databases and data policies in the life sciences.

BioSharing (http://www.biosharing.org) is a manually curated, searchable portal of three linked registries. These resources cover standards (terminologies, formats and models, and reporting guidelines), databases, and data policies in the life sciences, broadly encompassing the biological, environmental and biomedical sciences. Launched in 2011 and built by the same core team as the successful MIBBI portal, BioSharing harnesses community curation to collate and cross-reference resources across the life sciences from around the world. BioSharing makes these resources findable and accessible (the core of the FAIR principle). Every record is designed to be interlinked, providing a detailed description not only on the resource itself, but also on its relations with other life science infrastructures. Serving a variety of stakeholders, BioSharing cultivates a growing community, to which it offers diverse benefits. It is a resource for funding bodies and journal publishers to navigate the metadata landscape of the biological sciences; an educational resource for librarians and information advisors; a publicising platform for standard and database developers/curators; and a research tool for bench and computer scientists to plan their work. BioSharing is working with an increasing number of journals and other registries, for example linking standards and databases to training material and tools. Driven by an international Advisory Board, the BioSharing user-base has grown by over 40% (by unique IP address), in the last year thanks to successful engagement with researchers, publishers, librarians, developers and other stakeholders via several routes, including a joint RDA/Force11 working group and a collaboration with the International Society for Biocuration. In this article, we describe BioSharing, with a particular focus on community-led curation.Database URL: https://www.biosharing.org.

The process of installing REDCap, a web based database supporting biomedical research: the first year.

BACKGROUND: Clinical and research data are essential for patient care, research and healthcare system planning. REDCapTM is a web-based tool for research data curatorship developed at Vanderbilt University in Nashville, USA. The Faculty of Health Sciences at the University of the Witwatersrand, Johannesburg South Africa identified the need for a cost effective data management instrument. REDCap was installed as per the user agreement with Vanderbilt University in August 2012. OBJECTIVES: In order to assist other institutions that may lack the in-house Information Technology capacity, this paper describes the installation and support of REDCap and incorporates an analysis of user uptake over the first year of use. METHODS: We reviewed the staffing requirements, costs of installation, process of installation and necessary infrastructure and end-user requests following the introduction of REDCap at Wits. The University Legal Office and Human Research Ethics Committee were consulted regarding the REDCap end-user agreement. Bi-monthly user meetings resulted in a training workshop in August 2013. We compared our REDCap software user numbers and records before and after the first training workshop. RESULTS: Human resources were recruited from existing staff. Installation costs were limited to servers and security certificates. The total costs to provide a functional REDCap platform was less than $9000. Eighty-one (81) users were registered in the first year. After the first training workshop the user numbers increased by 59 in one month and the total number of active users to 140 by the end of August 2013. Custom software applications for REDCap were created by collaboration between clinicians and software developers. CONCLUSION: REDCap was installed and maintained at limited cost. A small number of people with defined skills can support multiple REDCap users in two to four hours a week. End user training increased in the number of users, number of projects created and the number of projects moved to production.

Proposal for a data publication and citation framework when sharing biomedical research resources.

Research data and biospecimen repositories are valuable resources for biomedical investigators. Sharing these resources has great potential benefits including efficient use of resources, avoiding duplicate experiments, gathering adequate sample sizes, and promoting collaboration. However, concerns from data producers about difficulties of getting proper acknowledgement for their data contributions are increasingly becoming obstacles for efficient and large-scale data sharing in reality. In this research project we analyzed the inadequacy of current policy-based solution for promoting data sharing. The recommendations in this paper emphasize data publication and citation. This project aims to promote the acknowledgement of data contributors with realizable informatics tools that augment informal policy-level strategies, and do so in a way that promotes data sharing.

Legal constraints on genetic data processing in European grids.

European laws on privacy and data security are not explicit about the storage and processing of genetic data. Especially whole-genome data is identifying and contains a lot of personal information. Is processing of such data allowed in computing grids? To find out, we looked at legal precedents in related fields, current literature, and interviews with legal experts. We found that processing of genetic data is only allowed on distributed systems with specific security measures, both technical and organizational. Informed consent, although important, offers no substitute for such requirements.

Ethical, legal and social issues for personal health records and applications.

Robert Wood Johnson Foundation's Project HealthDesign included funding of an ethical, legal and social issues (ELSI) team, to serve in an advisory capacity to the nine design projects. In that capacity, the authors had the opportunity to analyze the personal health record (PHR) and personal health application (PHA) implementations for recurring themes. PHRs and PHAs invert the long-standing paradigm of health care institutions as the authoritative data-holders and data-processors in the system. With PHRs and PHAs, the individual is the center of his or her own health data universe, a position that brings new benefits but also entails new responsibilities for patients and other parties in the health information infrastructure. Implications for law, policy and practice follow from this shift. This article summarizes the issues raised by the first phase of Project HealthDesign projects, categorizing them into four topics: privacy and confidentiality, data security, decision support, and HIPAA and related legal-regulatory requirements. Discussion and resolution of these issues will be critical to successful PHR/PHA implementations in the years to come.

Biobanco do Hospital de Clínicas de Porto Alegre: aspectos técnicos, éticos, jurídicos e sociais / Hospital de Clínicas de Porto Alegre biobank: technical, ethical, legal and social issues

As atividades de pesquisa em saúde cada vez mais necessitam do armazenamento de materiais biológicos em biorepositórios e em biobancos. O estabelecimento de políticas institucionais para lidar com aspectos técnicos, éticos, legais e sociais é imprescindível para garantir a sua adequação. O Hospital de Clínicas de Porto Alegre está com um projeto de desenvolvimento em execução para propiciar que estas atividades sejam harmônicas e integradas.

Health research increasingly requires the storage of biological samples in biorepositories and in biobanks. The establishment of institutional policies to deal with technical, ethical, legal and social issues is essential to ensure the adequacy of these activities. Hospital Clínicas de Porto Alegre has a development project to bring harmony and integration to these activities.

The price is now right. UnitedHealth Group's settlement on benchmarking databases could make out-of-network care costs more transparent, equal, some say.

Disagreement surrounds the discussion of whether the demise of two Ingenix price databases will aid the provider-payer relationship. Karen Ignagni, AHIP's CEO, questions the objective, wondering why in some cases "billings so exceed reimbursement." However, AMA President Nancy Nielsen, left, retorts, "This is an attempt to divert attention from what was clearly a rigged scheme".

A data protection framework for trans-European genetic research projects.

The paper proposes a data protection framework for trans-European medical research projects, which is based on a technical security infrastructure as well as on organizational measures and contractual obligations. It mainly relies on pseudonymization, an internal Data Protection Authority and on a Trusted Third Party. The outcome is an environment that combines both good research conditions and an extensive protection of patients' privacy.

An electronic registry for physiotherapists in Belgium.

This paper describes the results of the KINELECTRICS project. Since more and more clinical documents are stored and transmitted in an electronic way, the aim of this project was to design an electronic version of the registry that contains all acts of physiotherapists. The solution we present here, not only meets all legal constraints, but also enables to verify the traceability and inalterability of the generated documents, by means of SHA-256 codes. The proposed structure, using XML technology can also form a basis for the development of tools that can be used by the controlling authorities. By means of a certification procedure for software systems, we succeeded in developing a user friendly system that enables end-users that use a quality labeled software package, to automatically produce all the legally necessary documents concerning the registry. Moreover, we hope that this development will be an incentive for non-users to start working in an electronic way.

It's one step toward quality. Many hurdles remain to establishing new patient-safety groups, which will use confidential provider data on medical errors.

The new Patient Safety and Quality Improvement Act, passed late last month, would provide incentives for healthcare providers to report medical errors. While the idea behind the new bill is universally popular--to reduce errors and increase quality of care--some members of the industry, such as physician Steve McDermott, left, say that implementing a national reporting system will be harder than it sounds.

Risk management in waste water treatment.

With the continuous restructuring of the water market due to liberalisation, privatisation and internationalisation processes, the requirements on waste water disposal companies have grown. Increasing competition requires a target-oriented and clearly structured procedure. At the same time it is necessary to meet the environment-relevant legal requirements and to design the processes to be environment-oriented. The implementation of risk management and the integration of such a management instrument in an existing system in addition to the use of modern technologies and procedures can help to make the operation of the waste water treatment safer and consequently strengthen market position. The risk management process consists of three phases, risk identification, risk analysis/risk assessment and risk handling, which are based on each other, as well as of the risk managing. To achieve an identification of the risks as complete as possible, a subdivision of the kind of risks (e.g. legal, financial, market, operational) is suggested. One possibility to assess risks is the portfolio method which offers clear representation. It allows a division of the risks into classes showing which areas need handling. The determination of the appropriate measures to handle a risk (e.g. avoidance, reduction, shift) is included in the concluding third phase. Different strategies can be applied here. On the one hand, the cause-oriented strategy, aiming at preventive measures which aim to reduce the probability of occurrence of a risk (e.g. creation of redundancy, systems with low susceptibility to malfunction). On the other hand, the effect-oriented strategy, aiming to minimise the level of damage in case of an undesired occurrence (e.g. use of alarm systems, insurance cover).

Do you own your intellectual property?

A lack of caution at the beginning of a project can be costly, but the solution is simple.

Security middleware infrastructure for DICOM images in health information systems.

In health care, it is mandatory to maintain the privacy and confidentiality of medical data. To achieve this, a fine-grained access control and an access log for accessing medical images are two important aspects that need to be considered in health care systems. Fine-grained access control provides access to medical data only to authorized persons based on priority, location, and content. A log captures each attempt to access medical data. This article describes an overall middleware infrastructure required for secure access to Digital Imaging and Communication in Medicine (DICOM) images, with an emphasis on access control and log maintenance. We introduce a hybrid access control model that combines the properties of two existing models. A trust relationship between hospitals is used to make the hybrid access control model scalable across hospitals. We also discuss events that have to be logged and where the log has to be maintained. A prototype of security middleware infrastructure is implemented.