BHC Orthopaedic Registry

Established 1997 on BHC network to improve:

1) Access2) Security3) Backup4) Support5) HIS Integration6) Input load sharing

BHC Orthopaedic Registry

Direct physician point-and-click data entry to:1) improve data specificity & consistency for research 2) codify data for practice management & certification3) provide “just-in-time” alerts and CME4) reduce data collection redundancy & cost

HIPAA Calls3/27/2007

Concerns about security

No computer system is secure.

Business Associate Agreement (BAA) - 4/12/2007

Bellevue HIPAA requires a Bellevue BAA

until then

BELLEVUE ORTHO DATABASE ACCESS DENIED

Business Associate AgreementIndemnification Clause

”The Business Associate must agree to indemnify, defend, and hold harmless Bellevue Hospital and all of its … workforce against all losses suffered and all liability to third parties arising from or in connection with any material breach of this Agreement by the Business Associate.”

Liability insurance - unaffordable

BELLEVUE ORTHO DATABASE ACCESS DENIED

Business Associate AgreementIndemnification Claws

BHC Ortho Dept - 6/1/2007“We’ve got you covered.”

“I used to be a doctor,

then I was a provider,

now, I'm a

COVERED ENTITY”

William De Alva, M.D. Tucson, AZ

New BHC HIPAA Strategy:Move Goalposts - Play for Time

DataBase Clearances Required:

1) NYC HHC Legal 2) NYC HHC Research3) NYU SOM IRB4) MSSM IRB

until then

DATABASE ACCESS DENIED

One Year Later

• I am a covered entity within a covered entity.• Database has HHC Legal Office Review• Database has NYU IRB Clearance• Database has NYC HHC Research Office

Clearance• Database has DHHS OHRP Clearance

BELLEVUE ORTHO DATABASE ACCESS DENIED

HIPAA Says:You may have a Virus

Administrative VPN Access Denied

It’s OK if you sign a BAA

Liability Insurance - unaffordable

“You don’t have the funds to be on the playing field.”

DATABASE ACCESS DENIED

The Bottom Line

HIPAA appears to be much more concerned about the protection of the institution and its officers - rather than the privacy of patients and the quality of their care.

Eugene H. Spafford

“Data is not necessarily information.

Information does not necessarily lead to knowledge.

And knowledge is not always sufficient to discover truth and breed wisdom.”

NYU SoM IRB Findings 12/19/2007

• The Bellevue orthopaedic database is not research involving human subjects.

• The information does not require IRB review for human subjects research purposes or HIPAA purposes.

• The NYU SoM IRB does not consider Clinical Databases to be research data repositories.

NYC HHC Research Findings1/16/2008

• The NYU SoM IRB statement is accepted from an HHC Research Approval standpoint

• The OHRP DHHS regulations do not apply to the existing Bellevue Orthopaedic Department database