EHR Supporting_Statement_A_041514

Access to Electronic Health Record Data during an Outbreak

OSTLTS Generic Information Collection Request

OMB No. 0920-0879

Supporting Statement – Section A

Submitted: April 15, 2014

Program Officials/Project Officers

Elizabeth Mothershed, Deputy Director for Policy (Acting)

CDC/Division of Healthcare Quality and Promotion

1600 Clifton Rd, Mailstop A07, Atlanta, GA 30333

Phone: 404-639-4780

Email: [email protected]

Fax: 404-639-4043

Section A – Justification

1. Circumstances Making the Collection of Information Necessary

Background

This data collection is being conducted using the Generic Information Collection mechanism of the OSTLTS Survey Center (OSC) – OMB No. 0920-0879, Exp. date: 04/30/17. The respondent universe for this data collection aligns with that of the OSC. We will be requesting participation from the following 75 state health (HD) department employees in their official capacities: healthcare associated infection (HAI) coordinators/epidemiologists, legal counsel, and informatics director in the following state health departments: Florida, Indiana, Kansas, Maryland, Michigan, Minnesota, New Hampshire, New Jersey, New York, North Carolina, Ohio, Oregon, Tennessee, Texas, and Virginia.

September 18, 2013 marked the one-year anniversary of the healthcare associated infection (HAI) fungal meningitis outbreak that affected patients in 20 states and resulted in 751 infections, including 64 deaths. The outbreak highlighted the need for HDs to have electronic health record (EHR) access to quickly and efficiently identify potential cases; however, HD faced some significant challenges when requesting, getting, and using EHR access. An after action presentation and discussions with state HDs highlighted four main challenges related to the HAI fungal meningitis outbreak: legal concerns, the existence of few agreements to access and use data, their terms, and finally the capacity and skills related to EHR access and use¹.

First, challenges around authority, security and privacy, and federal law were cited for reasons that some facilities delayed HDs access to their EHR systems or denied access altogether. Many facilities and HDs lacked clear guidance on federal and state laws related to EHR security and patient privacy, particularly related to the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Although the Health Information Technology for Economic and Clinical Health (HITECH) Act² of 2009 provides a list of security and privacy requirements for EHR implementation, state laws and facility policies may impose additional requirements for security and privacy. Recent breaches of EHR security and the fear of financial and legal repercussions also complicated the facilities willingness to provide HDs EHR access. ^3,4

Second, few prior agreements existed before the fungal meningitis outbreak between HDs and healthcare facilities that outlined requirements for EHR access and use. Because EHRs are a relatively recent technology for many health care providers, EHR adoption has been uneven. Those adopting EHR technology has resulted because of incentives provided under HITECH Act; however, coordination of clinical care and public health is still under negotiation in many places. Therefore many HDs and healthcare facilities are relying on underdeveloped relationships. Although public health (PH) is included in the goals of HITECH, the funding and focus is clinically centered; therefore, the needs of PH have not generally been a consideration during EHR development and implementation within clinical care, perpetuating public health and clinical care incompatibilities. During the fungal meningitis outbreak, HDs and healthcare facilities were forced to make hasty short-term agreements about EHR access and use without thought to any plans for sustainability.

Third, the terms of the agreements between HD and facilities widely differed across jurisdictions and facilities. Even where HD officials were provided EHR access, the type of access and ability to retrieve information was inconsistent across facilities. Access was provided either at the facility or remotely. Those with access among facilities may have had access at just one of the hospital systems locations; therefore, if there was more than one location within the healthcare system the HD official had to individually visit each site daily costing valuable time in identifying potential cases. Those with remote access may have experienced technical difficulties because of capability and incompatibility factors (i.e. system interoperability.) Additionally, healthcare facilitates use various EHR vendors designed specifically to their individual clinical needs using institution specific nomenclature, further complicated the HDs ability to quickly and efficiently identify potential cases.

Finally, HD officials often lacked knowledge, skills, and training to use facilities’ unique EHR systems and technologies. The activities involved in finding and processing information was described as labor intensive. Furthermore, the ability to query an EHR system for a specific symptom or procedure proved challenging and in some cases unavailable. HDs were often left to create external data collection instruments that required a manually compilation of critical information. Additionally, many HDs did not have the technical infrastructure to receive information remotely, indicating problems with the interoperability of systems.

There is a limited understanding of the complexity of individualized challenges HDs faced when requesting EHR access during outbreaks. Therefore, the purpose of this data collection is to assess state health departments experience with EHR access by identifying real (i.e. lack of infrastructure and system incompatibilities to receive information)and perceived barriers (i.e. misinterpretation of Health Insurance Portability and Accountability Act), best practices, state policies, and lessons learned which will be compiled into a report and toolkit for states. A report and toolkit will be distributed to states to support awareness of best practices, barriers, and policies to help spur relationships between public health and clinical care in an effort to facilitate quick and efficient identification of those affected during the next outbreak.

This data collection is authorized by Section 301 of the Public Health Service Act (42 U.S.C. 241).

Privacy Impact Assessment

Overview of the Data Collection System – Information will be collected from the following 75 public health department employees in their official capacities: healthcare associated infection (HAI) coordinators/epidemiologists, legal counsels, and informatics directors to gain multiple perspectives since there were likely multiple HAI coordinators identifying cases during the HAI fungal meningitis outbreak. Data will be collected using telephone interviews in 15 state health departments: Florida, Indiana, Kansas, Maryland, Michigan, Minnesota, New Hampshire, New Jersey, New York, North Carolina, Ohio, Oregon, Tennessee, Texas, and Virginia.

Interview guides were developed for each of the public health official roles (see Attachment A-Interview Guide HAI Coordinators/Epidemiologists, Attachment B-Interview Guide Legal Counsels, Attachment C-Interview Guide Informatics Directors.) Each interview guide was pilot tested by two state health department employees with expertise in the area of the interview guide. Feedback was used to refine questions and probes, and estimate burden hours.

Items of Information to be collected –

Data will be collected from key stakeholders in states using telephone interviews.

Interviews will be conducted using interview guides specific to the role being interviewed (HAI coordinators/Epidemiologist, Legal Counsel, and Informatics Director.) In all three interview guides, there are six overarching questions:

1. What is your official title?

2. What has been your experience with the health department requesting and/or getting access to electronic health records from clinical providers in your jurisdiction?

3. How do you define electronic health record access in your jurisdiction?

4. What were some of the barriers [real or perceived] you experienced or heard about to help address requesting and/or getting electronic health record access?

5. What are the greatest lessons that you learned when requesting and/or getting electronic health record access?

6. What would you like to see in the toolkit that could help us to address health departments’ access to electronic health records?

Although the six overarching questions are similar between each of the interview guides, different probes are used to focus questions for each of the specific roles being interviewed. The probes serve as a guide for the interviewer should they need support during and to ensure all project objectives are being collected; therefore, not all of the probes will be used in every interview. For example, question two asks interviewee’s: “What has been your experience with the health department requesting and/or getting access to electronic health records from clinical providers in your jurisdiction?” Below demonstrates how different probes will be used by the interviewer for the different roles to support the interview with the above question:

• HAI Coordinators/Epidemiologist were likely the investigators of the outbreak; therefore, probes focus on:

  • Understanding how they requested and/or got EHR access

  • What kinds of EHR access they received and needed

  • Describing differences across facilities

  • How EHR access facilitated their investigation

  • Their relationship with the facilities before, during, and after they received EHR access

• Legal Counsel was likely more involved in providing advice and guidance; therefore, their probes focus on:

  • What kind of guidance they provided

  • Understanding the laws in their state that give HD EHR access

  • Their experience assisting HD with requesting and/or getting EHR access

• Informatics Directors were likely more involved in the technological aspects of EHR access; therefore, their probes focus on:

  • Understanding what kinds of technological expertise they provided

  • How that differed across facilities

  • Their experiences with different kinds of access (onsite versus remote)

Identification of Website(s) and Website Content Directed at Children Under 13 Years of Age –

The data collection system involves telephone interviews. A web-based data collection instrument will not be used. No website content will be directed at children.

2. Purpose and Use of the Information Collection

The purpose of this data collection is to better understand the complexity of issues surrounding key stakeholders in states EHR access in their jurisdiction. The information from this assessment will be compiled in a report and toolkit to provide states with a list of perceived barriers; suggestions to mitigate those barriers; best practices and policies that support EHR access; and practical tools such as templates for cooperative agreements, memorandums of understanding (MOUs) or policies. A report and toolkit will be distributed to states to support awareness of best practices, barriers, and policies to help spur relationships between public health and clinical care in an effort to facilitate quick and efficient identification of cases in future outbreaks.

Privacy Impact Assessment

All identifiable information will be stored in a secure location. Telephone interviews will be recorded and transcribed. Transcribed documents will be de-identified and reviewed for accuracy. Once accuracy is ensured in the transcribed documents, the recordings will be destroyed. All data will be reported at the state level to help ensure participant privacy.

3. Use of Improved Information Technology and Burden Reduction

Data will be collected by using telephone interviews with the support of an interview guide and probes for each of the different roles being interviewed. Telephone interviews were chosen for two reasons: First, this exploration is unprecedented; therefore, we are unable to use pre-determined questions that would provide a measureable reaction to a set number of questions, such as those used in a data collection instrument, to help explore their experience because we don’t know what their experience was. Instead phone interviews would provide us the ability to be flexible and responsive to their individual experiences through the use of open-ended questions and allow participants to use their own words and stories to describe and illustrate their experiences.

Second, a data collection instrument would not provide an in-depth understanding of the nuanced challenges HDs experienced when accessing EHRs in facilities in their jurisdiction. EHR access is likely dependent on a number of complex factors which could include, but are not limited to:

1. Authority-Does the health department have the authority or jurisdiction to access EHR? Authority challenges could include state laws, cooperative agreements, policies and interpretations. These could all be individual to both the HD and the facility EHRs they access.

2. Capacity-Does the HD have the ability for EHR access? Capacity challenges could include software compatibilities, type of access, policies, and information technology capability of HD personnel, all of which could be unique to each jurisdiction.

3. Security-How does security affect the HDs ability to access the EHR? Security challenges could include policies and interpretations both from the HD and the state.

4. Privacy-How does individual privacy affect EHR access for the HD? Privacy challenges could include existing federal laws such as the Health Insurance Portability and Accountability Act (HIPAA), state laws, and institutional policies.

5. Relationship-How does the relationship between the institution and the HD affect EHR access? Relationship challenges could include state laws that give HD authority but have affected their working relationship with facilities, written agreements, and history.

Therefore, the complexity and interaction of these factors makes interviews the best method of data collection to understand the challenges HDs have faced when requesting and/or getting EHR access in state HDs.

4. Efforts to Identify Duplication and Use of Similar Information

These data are unique to this project. Although issues have since been reported in an after action presentation and shared during discussions with HDs involved in the HAI fungal meningitis outbreak, there are no publications reporting HDs experiences accessing EHRs during an outbreak. Furthermore a legal assessment of HDs access to EHRs in an outbreak scenario has not been conducted. To further ensure this project is unique a literature review and legal assessment was conducted.

The literature review and legal assessment showed there is a lack of research focused on authority, state-local and public-private relationships, or capacity, security, and privacy, and that state laws related to EHR are not uniform. Although after action reports of the HAI fungal meningitis outbreak investigation identified a multitude of challenges around EHR access hindering the ability to quickly and efficiently identify potential cases, the focus of the investigation and subsequent publications have been on the clinical aspect of the outbreak, not the HDs challenges to requesting and/or getting EHR access in facilities.

5. Impact on Small Businesses or Other Small Entities

No small businesses will be involved in this data collection.

6. Consequences of Collecting the Information Less Frequently

Both HD EHR access and HAIs are emergent priorities of HHS and CDC. Specifically, without this data there would be:

• Continued challenges and reduction in the connectivity between public health and clinical care, a goal of the HITECH Act administered by the Office of the National Coordinator for Health Information Technology locate in the Office of the Secretary for the U.S. Department of Health and Human Services.

• A delay in future HAI outbreak investigations. HAIs are part of the CDC Winnable Battles campaign; a CDC agency priority.

• Risk for the health and safety of future patients affected by a HAI outbreak because HDs would lack the critical information necessary to quickly and efficiently identify potential cases therefore delaying notification of those affected that could result in negative outcomes.

This request is for a one-time data collection. There are no legal obstacles to reduce the burden.

7. Special Circumstances Relating to the Guidelines of 5 CFR 1320.5

There are no special circumstances with this information collection package. This request fully complies with the regulation 5 CFR 1320.5 and will be voluntary.

8. Comments in Response to the Federal Register Notice and Efforts to Consult Outside the Agency

This data collection is being conducted using the Generic Information Collection mechanism of the OSTLTS Survey Center (OSC) – OMB No. 0920-0879. A 60-day Federal Register Notice was published in the Federal Register on October 22, 2010, Vol. 75, No. 204; pp. 65353-54. Two comments were received from the Association of State and Territorial Health Officials (ASTHO), and the National Association of County and City Health Officials (NACCHO).

CDC partners with professional STLT organizations, such as the Association of State and Territorial Health Officials (ASTHO), the National Association of County and City Health Officials (NACCHO), and the National Association of Local Boards of Health (NALBOH) along with the National Center for Health Statistics (NCHS) to ensure that the collection requests under individual ICs are not in conflict with collections they have or will have in the field within the same timeframe.

9. Explanation of Any Payment or Gift to Respondents

CDC will not provide payments or gifts to respondents.

10. Assurance of Confidentiality Provided to Respondents

The Privacy Act does not apply to this data collection. All recordings will be destroyed after transcription and accuracy review. This data collection is not research involving human subjects.

11. Justification for Sensitive Questions

No information will be collected that are of personal or sensitive nature.

12. Estimates of Annualized Burden Hours and Costs

The estimate for burden hours is based on pilot tests of each of the interview guides. Each interview guide was tested by two state health department employees with expertise in the area of the interview guide. Feedback was used to refine questions and probes, and estimate burden hours.

In the pilot test for the HAI Coordinator/Epidemiologist, the average time to complete the interview, including time for reviewing instructions, was approximately 27-30 minutes. For the purposes of estimating burden hours, the upper limit of this range (i.e., 30 minutes) is used. In the pilot test of the Legal Counsel, the average time to complete the interview, including time for reviewing instructions, was approximately 37-40 minutes. For the purposes of estimating burden hours, the upper limit of this range (i.e. 40 minutes) is used. In the pilot test of the Informatics Directors, the average time to complete the interview, including time for reviewing instructions, was approximately 20-30 minutes. For the purposes of estimating burden hours, the upper limit of this range (i.e. 30 minutes) is used.

Estimates for the average hourly wage for respondents are based on the Department of Labor (DOL) National Compensation Survey estimate for management occupations – medical and health services managers in state government (http://www.bls.gov/ncs/ocs/sp/nctb1349.pdf). Based on DOL data, an average hourly wage varies depending on health official role we are interviewing. Table A-12 shows estimated burden and cost information for each of the roles in our sample.

Table A-12: Estimated Annualized Burden Hours and Costs to Respondents

Type of Respondent	No. of Respondents	No. of Responses per Respondent	Average Burden per Response (in hours)	Total Burden Hours	Hourly Wage Rate	Total Respondent Costs
State Counsel	15	1	40/60	10	$70.48	$704.80
HAI Coordinator/ Epidemiologist	45	1	30/60	23	$57.12	$1,313.76
Informatics Director	15	1	30/60	8	$30.07	$240.56
Totals	75	1		41		$2259.12

13. Estimates of Other Total Annual Cost Burden to Respondents or Record Keepers

There will be no direct costs to the respondents other than their time to participate in each telephone interview.

14. Annualized Cost to the Government

There are no equipment or overhead costs. The only cost to the federal government would be the salary of the CDC staff supporting the external contractor during the preparation of the interview guide, data collection and analysis activities. The estimated cost to the federal government is $31,877.50. Table A-14 describes how this cost estimate was calculated.

Table A-14: Estimated Annualized Cost to the Federal Government

Staff (FTE)	Average Hours per Collection	Average Hourly Rate	Average Cost
Director of Public Health Law (GS15) Support the development of instrument, pilot testing, review and oversee OMB package preparation, data analysis, report preparation	100	$56.95	$5,695.00
Associate Director for Behavioral Science (GS14) Support the development of instrument, pilot testing, review and oversee OMB package preparation, data analysis, and report preparation	150	$48.41	$7,261.50
Associate Director for Policy (Acting) (GS13) Support the development of instrument, pilot testing, review , oversee OMB package preparation, support data analysis, and report preparation	150	$40.97	$6,145.50
Public Health Analyst (GS12) Support the development of instrument, pilot testing, OMB package preparation, support data analysis, and report preparation	100	$34.35	$3,435.00
Evaluation Fellow (GS-11) Instrument development, pilot testing, OMB package preparation and report preparation. Support data collection, and data analysis.	150	$28.74	$4,311.00
External Contractor Data collection, data analysis, support in report preparation.	175	$28.74	$5,029.50
Estimated Total Cost of Information Collection			$31,877.50

15. Explanation for Program Changes or Adjustments

This is a new data collection.

16. Plans for Tabulation and Publication and Project Time Schedule

The information and lessons learned from this study will be compiled in a report and toolkit to provide states with a list of barriers; suggestions to mitigate those barriers; highlight best practices and policies that support EHR access; a menu of legal options; and may include practical tools such as templates for cooperative agreements, memorandums of understanding (MOUs) or policies.

A summary of this timeline is provided below:

Project Time Schedule

Design instrument questionnaire (COMPLETE)

Develop instrument protocol, instructions, and analysis plan (COMPLETE)

Pilot test instrument questionnaire (COMPLETE)

Prepare OMB package (COMPLETE)

Submit OMB package (COMPLETE)

OMB approval (TBD)

Email Announcing Project………………………………………………………………………………….. (1 week)

Emails sent to potential Participants, scheduling dates for interview, reminder email…………………………………………………………………………………………….……….………..… (2 week)

Practice Interviews with Contractor…………………………………………………………………… (1 week)

Administer instrument (4 weeks)

Collect, code, enter, quality control, and analyze data (3 weeks)

Prepare report (3 weeks)

Disseminate results/publication of findings (3 weeks)

17. Reason(s) Display of OMB Expiration Date is Inappropriate

We are requesting no exemption.

18. Exceptions to Certification for Paperwork Reduction Act Submissions

There are no exceptions to the certification. These activities comply with the requirements in 5 CFR 1320.9.

LIST OF ATTACHMENTS – Section A

Note: Attachments are included as separate files as instructed.

1. Phone Interview Guide for HAI Coordinators,/Epidemiologist

2. Phone Interview Guide for Legal Counsel

3. Phone Interview Guide for Informatics Directors

References

1. Hamilton, J.J (2013). Public Health Data and Informatics Needs during the Fungal Meningitis Outbreak. [PowerPoint slides]. Retrieved from http://www.amia.org/sites/amia.org/files/PHIWG-Meningitis-WebinarSlides.pdf

2. Health IT (2009). HITECH ACT. Retrieved from http://www.healthit.gov/policy-researchers-implementers/hitech-act

3. Shultz, D (2012). As Patients’ Records Go Digital, Theft and Hacking Problems Grow. Retrieved from http://www.kaiserhealthnews.org/Stories/2012/June/04/electronic-health-records-theft-hacking.aspx

4. Health and Human Services (2013). Idaho State University Settles HIPAA Security Case for $400,000. Retrieved from 20http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/isu-agreement-press-release.html.html13