Ask the Analyst: Compliance for Health Data Organizations

1.) What is compliance?

Compliance basically means following the rules. Whether you’re talking about state or federal laws, regulations, or policies and guidelines your organization sets, compliance is all about doing what you are supposed to do legally and ethically.

2.) Why is compliance important for an organization like CIVHC?

Health data organizations, like CIVHC, handle sensitive and protected health information. Compliance helps establish robust data security and privacy measures to protect this information. This includes adherence to various healthcare laws, data protection regulations, and other industry-specific requirements. Compliance is vital to maintaining the organization’s integrity, fostering trust with the community, and ensuring that the organization contributes positively to the healthcare ecosystem.

3.) As the Data Privacy and Compliance Officer, what is your role at CIVHC?

As the Data Privacy and Compliance Officer at CIVHC, I oversee a broad spectrum of activities designed to ensure our organization adheres to data privacy laws and upholds compliance standards. However, our compliance team isn’t confined to a silo. Interdepartmental collaboration is critical to our success in several areas: policies and procedures, continuous regulatory compliance, training and awareness, risk assessment and mitigation, data use evaluation, recordkeeping and documentation, monitoring and auditing, and data handling practices with legal standards and changing technological capabilities.

4.) What obstacles, barriers, etc., do you have to consider for your work?

Keeping abreast of evolving regulations, ensuring compliance, and adapting to changes can be challenging. One way we address this is through our Data Use Agreements and Data Management Plan guide. Compliance with privacy regulations like the Health Insurance Portability and Accountability Act of 1996 (HIPAA) is essential, and addressing privacy concerns involves a thorough compliance review of all data requests, review by CIVHC’s data release review committee as appropriate, and managing data access and destruction appropriately. Ensuring that data analyses can be shared in a way that benefits the public while addressing concerns about data confidentiality and competitive interests is a delicate balance.

5.) What are examples of not being compliant?

Organizations that manage or administer All Payer Claims Databases (APCD) must adhere to strict privacy standards. Any breach or mishandling of sensitive or protected health information could lead to non-compliance. This includes failures to implement proper security measures, unauthorized access to data, or insufficient protection against data breaches.

6.) What are the consequences of a healthcare database company’s non-compliance?

Given the sensitive nature of healthcare data, the consequences of non-compliance are particularly severe in the healthcare industry. Therefore, healthcare claims database organizations must prioritize compliance to protect their operations, reputation, and, most importantly, the privacy of the individuals whose data they handle.

It’s important to note that compliance issues can vary, and the consequences for non-compliance may depend on the severity and nature of the violations. Regulatory bodies, such as those overseeing healthcare data privacy, can impose substantial fines for non-compliance and restrict data processing until compliance is achieved, leading to delays and interruptions in services.

7.) How has maintaining compliance evolved over the years?

Healthcare compliance is rapidly evolving, thanks to technology advancements, regulatory changes, and shifts in healthcare practices. Most recently, Artificial Intelligence (AI) stands out as both a challenge and an opportunity in this landscape. As healthcare organizations increasingly rely on AI and data analytics for population health management, predictive analytics, and personalized medicine, they face new cybersecurity concerns. Protecting electronic health information has become more complex, requiring updated cybersecurity measures at a very fast pace.

8.) Can you share any examples of CIVHC adapting to new rules and regulations?

Through continuous monitoring and improvement, CIVHC is dedicated to staying ahead of the evolving healthcare data landscape. One example is our response to changes in substance use disorder (SUD) data regulations under the 2020 CARES Act. Recognizing the need for careful handling of sensitive SUD data, CIVHC collaborated with the Human Services Research Institute (HSRI) in 2022 to introduce a unique flagging system for SUD claims within the Colorado All Payer Claims Database. This initiative ensures that SUD claims are stored and managed separately, aligning with new legal requirements and safeguarding patient privacy. You can read more about the SUD flag here.