The impact of adopting EHRs: how losing connectivity affects clinical reasoning.

CONTEXT: As electronic health records (EHRs) are adopted by teaching hospitals, educators must examine how this change impacts trainee development. OBJECTIVES: We investigate this influence by studying clinician experiences of a hospital's move from paper charts to an EHR. We ask: how does each chart modality present conceptions of time and data interconnections? How do these conceptions affect clinical reasoning? METHODS: This two-phase, longitudinal study employed constructivist grounded theory. Data were collected at a paediatric teaching hospital before (Phase 1), during and after (Phase 2) the transition from a paper chart to an EHR system. Data collection consisted of field observations (146 hours involving 300 health care providers, 22 patients and 32 patient family members), think-aloud (n = 13) and think-after (n = 11) sessions, interviews (n = 39) and document retrieval (n = 392). Theories of rhetorical genre studies and visual rhetoric informed analysis. RESULTS: In the paper flowsheet, clinicians recorded and viewed patient data in chronologically organised displays that emphasised data interconnections. In the EHR flowsheet, clinicians viewed and recorded individual data points that were largely chronologically and contextually isolated. Clinicians reported that this change resulted in: (i) not knowing the patient's evolving status; (ii) increased cognitive workload, and (iii) loss of clinical reasoning support mechanisms. CONCLUSIONS: Understanding how patient data are interconnected is essential to clinical reasoning. The use of EHRs supports this goal because the EHR is a tool for collecting dispersed data; however, these collections often deconstruct data interconnections. Where the paper flowsheet emphasises chronology and interconnectedness, the EHR flowsheet emphasises individual data values that are largely independent of time and other patient data. To prepare trainees to work with EHRs, the ways of thinking and acting that were implicitly learned through the use of paper charts must be made explicit. To support clinical reasoning, medical educators should provide lessons in connectivity ­ the chronologically framed data interconnections upon which clinicians rely to provide patient care.

IT strategic planning in hospitals: from theory to practice.

OBJECTIVES: To date, IT strategic planning has been mostly theory-based with limited information on "best practices" in this area. This study presents the process and outcomes of IT strategic planning undertaken at a pediatric hospital (PH) in Canada. METHODS: A five-stage sequential and incremental process was adopted. Various tools / approaches were used including review of existing documentation, internal survey (n = 111), fifteen interviews, and twelve workshops. RESULTS: IT strategic planning was informed by 230 individuals (12 percent of hospital community) and revealed consistency in the themes and concerns raised by participants (e.g., slow IT projects delivery rate, lack of understanding of IT priorities, strained communication with IT staff). Mobile and remote access to patients' information, and an integrated EMR were identified as top priorities. The methodology and used approach revealed effective, improved internal relationships, and ensured commitment to the final IT strategic plan. Several lessons were learned including: maintaining a dynamic approach capable of adapting to the fast technology evolution; involving stakeholders and ensuring continuous communication; using effective research tools to support strategic planning; and grounding the process and final product in existing models. CONCLUSIONS: This study contributes to the development of "best practices" in IT strategic planning, and illustrates "how" to apply the theoretical principles in this area. This is especially important as IT leaders are encouraged to integrate evidence-based management into their decision making and practices. The methodology and lessons learned may inform practitioners in other hospitals planning to engage in IT strategic planning in the future.

Estimating the re-identification risk of clinical data sets.

BACKGROUND: De-identification is a common way to protect patient privacy when disclosing clinical data for secondary purposes, such as research. One type of attack that de-identification protects against is linking the disclosed patient data with public and semi-public registries. Uniqueness is a commonly used measure of re-identification risk under this attack. If uniqueness can be measured accurately then the risk from this kind of attack can be managed. In practice, it is often not possible to measure uniqueness directly, therefore it must be estimated. METHODS: We evaluated the accuracy of uniqueness estimators on clinically relevant data sets. Four candidate estimators were identified because they were evaluated in the past and found to have good accuracy or because they were new and not evaluated comparatively before: the Zayatz estimator, slide negative binomial estimator, Pitman's estimator, and mu-argus. A Monte Carlo simulation was performed to evaluate the uniqueness estimators on six clinically relevant data sets. We varied the sampling fraction and the uniqueness in the population (the value being estimated). The median relative error and inter-quartile range of the uniqueness estimates was measured across 1000 runs. RESULTS: There was no single estimator that performed well across all of the conditions. We developed a decision rule which selected between the Pitman, slide negative binomial and Zayatz estimators depending on the sampling fraction and the difference between estimates. This decision rule had the best consistent median relative error across multiple conditions and data sets. CONCLUSION: This study identified an accurate decision rule that can be used by health privacy researchers and disclosure control professionals to estimate uniqueness in clinical data sets. The decision rule provides a reliable way to measure re-identification risk.

A method for managing re-identification risk from small geographic areas in Canada.

BACKGROUND: A common disclosure control practice for health datasets is to identify small geographic areas and either suppress records from these small areas or aggregate them into larger ones. A recent study provided a method for deciding when an area is too small based on the uniqueness criterion. The uniqueness criterion stipulates that an the area is no longer too small when the proportion of unique individuals on the relevant variables (the quasi-identifiers) approaches zero. However, using a uniqueness value of zero is quite a stringent threshold, and is only suitable when the risks from data disclosure are quite high. Other uniqueness thresholds that have been proposed for health data are 5% and 20%. METHODS: We estimated uniqueness for urban Forward Sortation Areas (FSAs) by using the 2001 long form Canadian census data representing 20% of the population. We then constructed two logistic regression models to predict when the uniqueness is greater than the 5% and 20% thresholds, and validated their predictive accuracy using 10-fold cross-validation. Predictor variables included the population size of the FSA and the maximum number of possible values on the quasi-identifiers (the number of equivalence classes). RESULTS: All model parameters were significant and the models had very high prediction accuracy, with specificity above 0.9, and sensitivity at 0.87 and 0.74 for the 5% and 20% threshold models respectively. The application of the models was illustrated with an analysis of the Ontario newborn registry and an emergency department dataset. At the higher thresholds considerably fewer records compared to the 0% threshold would be considered to be in small areas and therefore undergo disclosure control actions. We have also included concrete guidance for data custodians in deciding which one of the three uniqueness thresholds to use (0%, 5%, 20%), depending on the mitigating controls that the data recipients have in place, the potential invasion of privacy if the data is disclosed, and the motives and capacity of the data recipient to re-identify the data. CONCLUSION: The models we developed can be used to manage the re-identification risk from small geographic areas. Being able to choose among three possible thresholds, a data custodian can adjust the definition of "small geographic area" to the nature of the data and recipient.

Evaluating the Risk of Re-identification of Patients from Hospital Prescription Records.

BACKGROUND: Pharmacies often provide prescription records to private research firms, on the assumption that these records are de-identified (i.e., identifying information has been removed). However, concerns have been expressed about the potential that patients can be re-identified from such records. Recently, a large private research firm requested prescription records from the Children's Hospital of Eastern Ontario (CHEO), as part of a larger effort to develop a database of hospital prescription records across Canada. OBJECTIVE: To evaluate the ability to re-identify patients from CHEO'S prescription records and to determine ways to appropriately de-identify the data if the risk was too high. METHODS: The risk of re-identification was assessed for 18 months' worth of prescription data. De-identification algorithms were developed to reduce the risk to an acceptable level while maintaining the quality of the data. RESULTS: The probability of patients being re-identified from the original variables and data set requested by the private research firm was deemed quite high. A new de-identified record layout was developed, which had an acceptable level of re-identification risk. The new approach involved replacing the admission and discharge dates with the quarter and year of admission and the length of stay in days, reporting the patient's age in weeks, and including only the first character of the patient's postal code. Additional requirements were included in the data-sharing agreement with the private research firm (e.g., audit requirements and a protocol for notification of a breach of privacy). CONCLUSIONS: Without a formal analysis of the risk of re-identification, assurances of data anonymity may not be accurate. A formal risk analysis at one hospital produced a clinically relevant data set that also protects patient privacy and allows the hospital pharmacy to explicitly manage the risks of breach of patient privacy.

Mapping communication spaces: The development and use of a tool for analyzing the impact of EHRs on interprofessional collaborative practice.

INTRODUCTION: Members of the healthcare team must access and share patient information to coordinate interprofessional collaborative practice (ICP). Although some evidence suggests that electronic health records (EHRs) contribute to in-team communication breakdowns, EHRs are still widely hailed as tools that support ICP. If EHRs are expected to promote ICP, researchers must be able to longitudinally study the impact of EHRs on ICP across communication types, users, and physical locations. OBJECTIVE: This paper presents a data collection and analysis tool, named the Map of the Clinical Interprofessional Communication Spaces (MCICS), which supports examining how EHRs impact ICP over time, and across communication types, users, and physical locations. METHODS: The tool's development evolved during a large prospective longitudinal study conducted at a Canadian pediatric academic tertiary-care hospital. This two-phased study [i.e., pre-implementation (phase 1) and post implementation (phase 2)] of an EHR employed a constructivist grounded theory approach and triangulated data collection strategies (i.e., non-participant observations, interviews, think-alouds, and document analysis). The MCICS was created through a five-step process: (i) preliminary structural development based on the use of the paper-based chart (phase 1); (ii) confirmatory review and modification process (phase 1); (iii) ongoing data collection and analysis facilitated by the map (phase 1); (iv) data collection and modification of map based on impact of EHR (phase 2); and (v) confirmatory review and modification process (phase 2). RESULTS: Creating and using the MCICS enabled our research team to locate, observe, and analyze the impact of the EHR on ICP, (a) across oral, electronic, and paper communications, (b) through a patient's passage across different units in the hospital, (c) across the duration of the patient's stay in hospital, and (d) across multiple healthcare providers. By using the MCICS, we captured a comprehensive, detailed picture of the clinical milieu in which the EHR was implemented, and of the intended and unintended consequences of the EHR's deployment. The map supported our observations and analysis of ICP communication spaces, and of the role of the patient chart in these spaces. CONCLUSIONS: If EHRs are expected to help resolve ICP challenges, it is important that researchers be able to longitudinally assess the impact of EHRs on ICP across multiple modes of communication, users, and physical locations. Mapping the clinical communication spaces can help EHR designers, clinicians, educators and researchers understand these spaces, appreciate their complexity, and navigate their way towards effective use of EHRs as means for supporting ICP. We propose that the MCICS can be used "as is" in other academic tertiary-care pediatric hospitals, and can be tailored for use in other healthcare institutions.

A globally optimal k-anonymity method for the de-identification of health data.

BACKGROUND: Explicit patient consent requirements in privacy laws can have a negative impact on health research, leading to selection bias and reduced recruitment. Often legislative requirements to obtain consent are waived if the information collected or disclosed is de-identified. OBJECTIVE: The authors developed and empirically evaluated a new globally optimal de-identification algorithm that satisfies the k-anonymity criterion and that is suitable for health datasets. DESIGN: Authors compared OLA (Optimal Lattice Anonymization) empirically to three existing k-anonymity algorithms, Datafly, Samarati, and Incognito, on six public, hospital, and registry datasets for different values of k and suppression limits. Measurement Three information loss metrics were used for the comparison: precision, discernability metric, and non-uniform entropy. Each algorithm's performance speed was also evaluated. RESULTS: The Datafly and Samarati algorithms had higher information loss than OLA and Incognito; OLA was consistently faster than Incognito in finding the globally optimal de-identification solution. CONCLUSIONS: For the de-identification of health datasets, OLA is an improvement on existing k-anonymity algorithms in terms of information loss and performance.