Ann Thorac Surg 2008;86:695-698. doi:10.1016/j.athoracsur.2008.04.075
© 2008 The Society of Thoracic Surgeons
Editorial
The Rationale for Incorporation of HIPAA Compliant Unique Patient, Surgeon, and Hospital Identifier Fields in The STS Database
Jeffrey P. Jacobs, MD, FACSa,*,
Constance K. Haan, MD, MSb,
Fred H. Edwards, MDb,
Richard P. Anderson, MDc,
Frederick L. Grover, MDd,
John E. Mayer, Jr, MDe,
W. Randolph Chitwood, Jr, MD, FACSf
a The Congenital Heart Institute of Florida (CHIF), All Children's Hospital and Saint Josephs Children's Hospital of Tampa, University of South Florida College of Medicine, Cardiac Surgical Associates, Saint Petersburg and Tampa, Florida
b University of Florida, Gainesville and Jacksonville, Florida
c Virginia Mason Medical Center, Seattle, Washington
d University of Colorado Denver, School of Medicine, Aurora, Colorado
e Children's Hospital Boston, Harvard University, Boston, Massachusetts
f Brody School of Medicine, East Carolina University, Greenville, North Carolina
* Address correspondence to Dr Jacobs, The Congenital Heart Institute of Florida (CHIF), Cardiac Surgical Associates (CSA), 625 Sixth Ave S, Suite 475, Saint Petersburg, FL 33701 (Email: jeffjacobs{at}msn.com).
 |
Introduction
|
|---|
As cardiothoracic surgeons, one of our professional responsibilities is the longitudinal follow-up of patients undergoing cardiothoracic surgery. The Society of Thoracic Surgeons (STS) database is the largest clinical cardiothoracic surgical database in North America and currently includes 1,051 participating sites with 3,202 participating surgeons (ie, in the adult cardiac surgery database there are 881 participants and 2,682 surgeons; in the general thoracic surgery database there are 98 participants and 345 surgeons; and in the congenital database there are 72 participants and 175 surgeons). Data in The STS database is verified through both an intrinsic data verification process, designed to rectify inconsistencies of data and missing elements of data, as well as an onsite audit program, with verification of the data at the primary source of the data. Presently The STS databases provide only in-hospital and 30-day follow-up of patients. Recognizing the critical importance of long-term follow-up, The STS Workforce on National Databases has initiated a strategy to facilitate longitudinal follow-up of patients in the database. A key element of this strategy entails the use of specific identifiers that will permit long-term tracking of important patient events. Accordingly, on January 1, 2008, The STS database began collecting Health Insurance Portability and Accountability Act (HIPAA) Compliant Unique Patient, Surgeon, and Hospital Identifier Fields. (In this Editorial, we will refer to "HIPAA Compliant Unique Patient, Surgeon, and Hospital Identifier Fields" as "Identifier Fields.") Blast e-mails announcing these plans were sent to The STS database participants on April 24, 2007 and January 17, 2008. The purpose of this editorial is to document the rationale for the incorporation of these new fields of data into The STS database.
The Identifier Fields were added to The STS adult cardiac surgery database beginning January 1, 2008, and similar fields will be added to The STS general thoracic surgery and congenital heart surgery databases. These identifiers are necessary to enable the database to function as a tool for longitudinal follow-up of patients, with a specific focus on long-term survival and functional status of patients postoperatively. This new functionality will allow the database to achieve multiple goals: (1) verify mortality data with statewide and national death registries, (2) link The STS data with other subspecialty databases, (3) link and follow patients having multiple operations in different institutions, (4) link and follow patients who have had operations in more than one of our three databases (adult cardiac surgery, general thoracic surgery, and congenital heart surgery), (5) perform long-term follow-up of repeat hospital admissions and additional procedures, and (6) generate Kaplan-Meier survival curves from our data. The surgeon identifiers will also facilitate using The STS database as a tool for reporting to the Physician Quality Reporting Initiative of CMS.
|
Legal Issues
|
|---|
The STS databases are compliant with the HIPAA of 1996 [1, 2]. The Participation Agreement with The STS, and the Appendix I of the Business Associate Contract & Data Use Agreement, acknowledge that Participants in the database, The STS, and Duke Clinical Research Institute, agree to comply with all statutes and regulations under federal and state laws concerning patient privacy and data security, including but not limited to the privacy regulations promulgated under HIPAA [1]. The "Privacy Rule" is a regulation under HIPAA that restricts the use and disclosure of "Protected Health Information" (PHI) by "covered entities" [2, 3]. The PHI is any "individually identifiable health information" kept in electronic format. "Individually identifiable health information" is information that (1) is created or received by a healthcare provider, health plan, employer, or healthcare clearinghouse; (2) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and (3) identifies the individual; or with respect to which there is a reasonable basis to believe the information can be used to identify the individual. A "covered entity" under the HIPAA is divided into the following categories: (1) hospitals, physicians, and other healthcare providers who transmit PHI electronically to process healthcare claims and billing. Providers may include community clinics, social service agencies, and practitioners in psychology, psychotherapy, and social work; (2) health insurers, health maintenance organizations (HMOs), health plans; and (3) healthcare clearinghouses. The STS Database participants are HIPAA covered entities [2, 3]. It does not in any way violate HIPAA to collect and document the life status of a patient 30 days after surgery.
The STS has entered into a Business Associate/Data Use Agreement with each database participant, which complies with HIPAA, thereby protecting the security and privacy of patient data. This agreement also permits The STS and its data warehouse and analysis center, Duke Clinical Research Institute, to incorporate fully-identified PHI into the database for purposes of participants' healthcare operations, including data aggregation, quality improvement, outcomes evaluation, and development of clinical guidelines. Prior to 2008, The STS accepted only submissions of limited data set information into the database, rather than fully-identified PHI. To the extent that the addition of Identifiers to the submitted information will be used to support healthcare quality improvement efforts by institutions (ie, by permitting The STS to provide Participants in the database with an enhanced range of information to support their healthcare Operations), the assignment of Identifiers to data collected from Participants in the database will be covered by existing Business Associate/Data Use Agreements. The addition of the identifiers will not significantly add to the amount of information submitted on each patient, and there will be no other requirement, at this time, for the acquisition of follow-up information.
Because some of the aggregated data (in the database) and analyses (using data submitted with identifiers) will be used for research purposes, the Duke Clinical Research Institute obtained institutional review board approval for inclusion of identifiers in The STS database. This approval covers submissions of identifier fields by participants, as well as the data aggregation, and the analyses performed using de-identified aggregated data for research-related purposes. The Duke Clinical Research Institute will obtain separate institutional review board approval for any specific research projects using data with identifiers. It should not be necessary for individual participants to seek separate approval from their own institution's review board for the submission of data with identifiers. Nevertheless, to assist those institutions wishing to do so, The STS prepared supporting documentation that clearly shows that our plans to incorporate identifier fields into The STS Database are compliant with HIPAA. The STS database participants can request this supporting documentation via e-mail from the following address: phi@sts.org. The STS will send the following legal, operational, technical, and bioethical documents:
- (1) A memorandum from The STS outside legal counsel that provides an analysis of HIPAA related to The STS database collection of PHI.
- (2) A letter from the of the Duke Institutional Review Board Chair confirming that the Duke Institutional Review Board approved the incorporation of Identifier Fields into The STS database, and outlining the operational strategy that the Duke Clinical Research Institute will use to accomplish this task.
- (3) A document that addresses the applicability of HIPAA to The STS database and related frequently asked questions (FAQs). This document describes the technical strategies implemented to assure safety of the data and compliance with HIPAA [1–5].
- (4) A summary of the bioethical arguments surrounding The STS approach.
|
Database Links and Longitudinal Follow-Up
|
|---|
Several initiatives are underway to enhance the abilities of The STS Database to function as a tool for longitudinal follow-up. These initiatives involve both obtaining follow-up data from other databases and linking The STS databases to other databases. All data linking agreements will be strictly adherent to HIPAA privacy regulations. We firmly believe that this new capacity for long-term follow-up will be an invaluable resource for our profession.
Obtaining Data from Death Indices—The National Death Index and the Social Security Death Master File
The STS has evaluated the possibility of obtaining information from the National Death Index (NDI) and the Social Security Death Master File (SSDMF) to verify life status over time. Initial plans are to use the SSDMF (which is also known as the Social Security Death Index [SSDI]) for this purpose. The expense associated with using the NDI to verify life status of the entire STS database is prohibitive at this time; however, the SSDMF is affordable. Furthermore, the NDI can only be used in medical or healthcare research and can not be used for legal or administrative purposes or for nonresearch related healthcare operations and quality improvement initiatives. The SSDMF places no such restriction on the use of its data. Use of the SSDMF will function as a proof of concept that may support legislation to make the use of the NDI a realistic option in the future. During the process of obtaining information from NDI or SSDMF, no clinical information leaves The STS database. By verifying life status with the SSDMF, The STS database will be able to generate Kaplan- Meier survival curves for various subsets of patients within The STS database. The power of this data offers the potential to generate Kaplan-Meier survival curves for millions of patients undergoing cardiothoracic surgery. Moreover, data from the SSDMF and NDI will facilitate both long-term follow-up and verification of life status during the time interval between hospital discharge and 30 days after surgery.
Links to Administrative Databases—Centers for Medicare & Medicaid Services
By linking The STS database with administrative claims data from the Centers for Medicare & Medicaid Services (CMS), it will be possible to obtain longitudinal follow-up in many areas including (1) death, (2) readmission diagnosis, (3) readmission date, (4) procedure, (5) procedure date, and (6) procedure cost (both during the index procedure and for procedures on subsequent admissions). A variety of studies then become feasible: (1) Documentation of the penetration of participation in The STS Database by answering the question, "What percentage of all hospitals submitting Medicare claims for adult cardiac surgery also submit data to The STS?" (2) Documentation of the completeness of the hospital caseload within The STS database by answering the question, "What percentage of adult cardiac operations submitted as Medicare claims at a given hospital are also submitted to The STS database?" (Although this question is also addressed during The STS on-site audits, these audits might not always take place in the context of an actual hospital because The STS database participants may comprise a surgical practice that operates at more than one hospital). (3) Documentation of the representativeness of The STS data by answering the question: "Taking into account the inherent limitations of claims data, how do the clinical, demographic, and operative characteristics of cases that enter The STS database compare with those that do not enter the database?" (4) Longitudinal follow-up studies looking at rates of readmission, reoperation, and death. (5) Cost analysis studies that potentially relate quality-of-care to cost. Database links, similar to those between The STS database and the CMS database, can be created between The STS database and claims databases from private insurance carriers. These links with claims databases from private insurance carriers would allow capture of the same type of data obtained from the CMS, but for a younger non-Medicare population.
Links to Other Clinical Databases—American College of Cardiology National Cardiovascular Data Registry
While links to administrative claims databases provide valuable information, links to other clinical databases will provide additional complementary data including potentially the date of the last follow-up of the patient and the New York Heart Association (NYHA) functional class status at the last follow-up, as well as data about medications and noncardiac surgical operations and interventions. This type of database linkage is exemplified by ongoing efforts to link The STS database to the National Cardiovascular Data Registry (NCDR) of the American College of Cardiology (ACC). Definitions of data elements in the databases of The STS and ACC have been harmonized. Collaborative efforts between The STS database and the databases of the ACC can lead to the achievement of many goals:
- 1 Create a combined data set. To achieve this goal, the two registries will need to incorporate similar, if not identical, unique identifiers to link patient records. De-identification of the combined records will allow for the creation of a research database. (The STS has already provided the ACC with The STS list of HIPAA Compliant Unique Patient Identifiers.)
- 2 Create a combined vendor certification process. By achieving this objective, we will create methodology, whereby software vendors could create a combined software package that could be jointly certified by both The STS and ACC. This software would allow participation in both databases with a single software program with shared demographics between the two registries.
- 3 Jointly acquire administrative data sets (such as CMS). By achieving this objective, we will be able to link administrative data sets to the combined STS-ACC data set and to each individual database as well. Both the ACC and The STS might save money through the joint acquisition of administrative data sets.
- 4 Create a methodology for the collaborative collection of longitudinal follow-up data. By achieving this objective, we will create the methodology that would allow for the collaborative collection of longitudinal follow-up data for appropriate patients. A protocol for longitudinal follow-up could be jointly developed and approved by The STS and the ACC. A system could be developed and implemented in which follow-up data is shared between The STS database and the ACC database to establish a continuum of care for study and assessment.
- 5 Capitalize on the combined strength of both registries for initiatives of mutual benefit to the ACC and The STS.
The combined strength of the databases of The STS and ACC can be used to lobby for initiatives that are mutually beneficial to both the ACC and STS. For example, the ACC and The STS could coordinate a combined effort to lobby for the authorization of the use of the ACC and The STS registries as a tool for ACC and STS members to qualify for the Physician Quality Reporting Initiative (PQRI). Similarly, collaborative efforts could support legislation to make use of the NDI a realistic option.
Potential database linkages are being explored with many other clinical databases including the Virtual Pediatric Intensive Care Unit Database System (VPS database) of the Pediatric Cardiac Intensive Care Society, the Extracorporeal Life Support Organization (ELSO) Registry, and the soon to be created ACC Congenital Cardiology database named Improving Pediatric and Adult Congenital Treatment (IMPACT). Each of these linkages has the potential to obtain data similar to that exemplified by the ACC NCDR linkage.
|
The Future
|
|---|
The rationale for the incorporation of HIPAA Compliant Unique Patient, Surgeon, and Hospital Identifier Fields into the STS Database is to enhance the ability of the STS Database to function as a tool for longitudinal follow-up. The ability to obtain data from national death registries, administrative claims databases, and other clinical databases, is vital to this objective. Each of these data sources will provide different and complementary data as exemplified by the database links briefly summarized in this editorial. Data is power [6]. Obtaining and analyzing powerful, longitudinal follow-up data is not only our professional responsibility [7], but also a critical element in determining the optimal treatment choice from the array of medical and surgical options currently in practice.
|
References
|
|---|
- http://www.sts.org/sections/stsnationaldatabase/hipaa/Accessed February 10, 2008.
- http://www.sts.org/documents/pdf/DCRI_FAQ-Technical_Document_re_Identifiers_in_Database_Final.pdfAccessed February 10, 2008.
- http://privacyruleandresearch.nih.gov/Accessed February 10, 2008.
- http://www.hhs.gov/ohrp/Accessed February 10, 2008.
- http://www.hhs.gov/ohrp/humansubjects/guidance/cdebiol.htmAccessed February 10, 2008.
- Jacobs JP. Lessons from National Quality Indicators for Congenital Heart Surgery: how to use data to enhance your practice (why have a database? Outcomes analysis, benchmarking, quality assurance and pay-for-performance). Presented at The Practice Education Session of the Society of Thoracic Surgeons Work Force on Practice Education at 44th Annual Meeting of The Society of Thoracic Surgeons, Fort Lauderdale, FL, January 28, 2008.
- Mayer JE Jr. Presidential Address given at the 44th Annual Meeting of The Society of Thoracic Surgeons, Fort Lauderdale, FL, January 28, 2008.
Top
Introduction
Legal Issues