Creating Governance Models for Health Data Sharing: Lessons Learned

Paul Biondich, MD MS Lauren Wu, MHS and Theresa Cullen,

MD MS February 1st, 2017

What We’ll Cover • What is governance and why is it important

for our work • Our experiences in governance models • How we incubate those structures today • Describe what these entities do once they’re

established • Lessons we’ve learned along the way • Tools we’re developing to make this easier • Hopefully lots of discussion throughout!

2

3

Governance

What I Mean by Governance

• System by which an activity or an organization is directed and controlled

• Establishment of policies/procedures, and continuous monitoring of their proper implementation, by the individuals who oversee an activity.

4

Why I care about governance? • Many countries are in the process of developing

their “urban plan” for health data sharing (HIE) • Milieu within most LMIC makes this challenging

– Underdeveloped – Local capacity vs. External capacity – Influx of outside resources

• Governance = key enabler for successful HIE in LMIC – Policies: laws, national strategies, legal agreements – Procedures: implementation guidance, standards

5

Governance Experiences…

• Review of 28 low- and middle-income countries (21% of all LMIC) – Mixed-method qualitative review using literature

review and semi-structured interviews in a “network” approach with primary contacts who are implementers in the OpenHIE community

• Direct experiences me and my team have had working within a dozen countries for over 13 years..

6

Countries We’ve Learned About…

7

# and Proportion of LMIC Reviewed by Region: Africa n=17, 33% Asia n=5, 17% Central America & Caribbean n=2, 12%

Europe n=1, 8% South America n=3, 43%

Governance Development Steps

1. Determine Goal(s) 2. Select Stakeholders 3. Document Mission, Vision, Values 4. Determine Initial Strategic Objectives 5. Develop Decision-making Processes

8

9

Determine Goal(s)

Lessons Learned – Goal Setting

• The “five whys” technique is often very useful.. – Rwanda, Tanzania

• Encourage balance between rabid ambition and worthless when considering scope – Many state initiatives within US

• Goals should ideally align with incumbent authority/power base within environment – Nigeria

10

11

Select Stakeholders

Lessons Learned - Stakeholders

• People have almost primal need to feel included in order for them to trust, err on side of being more inclusive to broader group

• Know your potential critics and find ways to include them

• Encourage their immediate participation in all subsequent steps if possible/viable to create shared sense of ownership

• Many environments have very different perceptions of data ownership!

12

13

Document Mission, Vision, Values

Lessons Learned - MVV

• Explicit documentation of both mission and vision provides both upfront guidance to the community and allows them to dream about future possibilities – Nigeria

• Value misalignments grow as stakeholder numbers grow – Philippines

• Clear MVV serve as a “governor” for future stakeholder membership

14

15

Determine Strategic Objectives

Lessons Learned – Strategic Objectives

• “Hack in the right direction” • Need to deliver value **quickly**

• Make sure strategic objectives crosswalk against a use case fundamentally important to

stakeholders

16

17

Develop Decision-Making Processes

Lessons Learned – Decision Making

• More people involved, longer it takes to arrive at decision

• Super important to distinguish between need to be responsible/accountable and informed/consulted for each stakeholder

• Those accountable for decisions often need support from those with SME

18

19

Philippines Governance

20

Nigerian Governance

21

What do they develop/oversee?

1. Information Standards 2. Privacy and Security 3. Data Use Agreements 4. Implementation Standards 5. Education / Capacity Development 6. Monitoring / Evaluation

22

What We’ve Seen • Use Cases for HIE: Vary by country and donor priorities

(M&E requirements vs. universal health coverage) • eHealth Strategies: Generally address governance &

partnerships, enterprise architecture, patient identification, standards/interoperability, privacy & security – Countries are in various states of implementing the

policy • Data Ownership/Stewardship: Tends toward view of data

ownership, usually by MoH. Few offer patient access.

23

• Governance: Implementation and maturity vary (priority in places focusing on enterprise-wide architecture and UHC; siloed where dependence on donor funding/strong private sector)

• Data Use: Focus on aggregate level reporting for M&E, individual-level HIE demonstrated for pilots/regionally

• Legal tools: – Data use agreements - not established in many cases,

sometimes seen as unnecessary for in-country exchange – Privacy & security - lack of legal frameworks

24

What We’ve Seen

25

Recommended Framework Structure

• Key domains in the development of country policies and procedures for HIE: 1. Vision and Strategy (9 decision points) 2. Governance* (5 decision points) 3. HIE Policies & Procedures – General (2 decision points) 4. HIE Policies & Procedures – Standards and

Interoperability (4 decision points) 5. HIE Policies & Procedures – Privacy and Security (2

decision points) 6. HIE Policies & Procedures – Data Use Agreements* (13

decision points) 7. HIE Implementation (5 decision points)

26

Example Framework Section

27

Theme Exemplar

Question/Decision Point(s)

Example Option Where Implemented or Planned Digital

Development Principle(s)

Data Use Agreement

What is the anticipated use of data – site-to-site sharing or regional/national data sharing, and what type of data sharing agreement may be needed to support the outcome? For site-to-site data sharing, consider point-to-point agreements. For regional/national data sharing, consider multi-party data use and exchange agreements.

No data use agreement in place. The MoH is the main decision-making party and there has not been a need for an agreement for intra-country data sharing thus far.

Rwanda

Understand the ecosystem; Address privacy and security; Design for scale; Be collaborative

Data use agreement in place between the MoH, Ministry of ICT, and the national insurance corporation. (point-to-point) However, the agreement specifies requirements of participation for providers in the network.

Philippines

Formal MOU agreement between the social health insurance bureau and primary health centers must be signed by the District Health Office Director. (appears to be multi-party)

Indonesia

Data use agreement in place between two districts sharing a country border for sharing of Ebola surveillance data. (point-to-point) Note this agreement also includes stipulations for sharing of physical resources (e.g., ambulances , laboratories, staff – surveillance and funeral teams).

Kambia District in Sierra Leone and Forecariah District in Guinea

Scalable, multi-trust agreement for a data sharing network

eHealth ExchangeTM network in United States; Carequality® exchange network in United States; Among health programs operated by Indian tribes, tribal organizations, and urban Indian organizations that are Covered Entities and desire to engage in HIE using the Indian Health Service (IHS) HIE (per IHS Multi-Purpose Agreement (MPA))

Best Practices Features

• HIE Governance in the Philippines • Policies for eHealth and HIE in Peru • Standards and Guidelines in Kenya • Data Use Agreements in the United States

28

Thank You!

pbiondic@regenstrief.org

http://openmrs.org http://ohie.org

http://cbmi.regenstrief.org

Want this slide deck? Scan the QR code, or http://pgb.me/hsph2