Software tool aids research protects confidentiality
A trip through the 'Clinical Looking Glass'
Improving ease of access to potential research data while aggressively protecting identifiable patient information — it's a goal that many institutions struggle with.
At Montefiore Medical Center in New York City, doctors and researchers are using an innovative electronic tool that takes the reams of data produced each day by the hospital and makes it searchable for use in quality improvement, physician training, hospital operations and research.
While it holds enormous potential, the software known as Clinical Looking Glass (CLG) also holds the key to thousands of patients' identifiable private health information, a factor that led its developers to bring Montefiore's IRB into the discussion from its inception, says Eran Bellin, MD, vice president for clinical IT research and development, who was instrumental in designing CLG.
"Before we built this application, we were working very closely with the IRB," Bellin says. "I was a member of the IRB as well and I was in charge of the HIPAA security group at the hospital. We took this issue very, very seriously."
The result is a system with tiers of access, depending upon the needs of the questioner. Access to the most sensitive information requires either IRB approval or permission from others in authority at the institution, all of whom monitor and audit the use of those permissions.
Victor Hatcher, PhD, director of the Office for Research and Sponsored Programs and the Office for Clinical Trials, says the system provides a unique opportunity to increase research while giving the IRB necessary oversight abilities.
"It's created an opportunity for the investigators to perform more IRB-type studies," he says. "When we see how many people are using it, we're pleased. We look at it as a good thing. It's an excellent tool."
'Restricted' vs. 'privileged'
Bellin says that the process of developing CLG began with the creation of an electronic medical record (EMR) at Montefiore. The EMR collects data from throughout the medical center, including laboratory, pharmacy, and admission, discharge and transfer data.
Early attempts to query the EMR for quality improvement purposes were unsuccessful, requiring too much CPU capacity. So the institution replicated the EMR in a separate database, which is updated daily. That is the database CLG searches.
At that point, Bellin says, the developers had to figure out rules of access to information. They created two levels of access. The restricted mode allows access to deidentified records, which are defined as a limited data set under HIPAA because they do include dates of birth and dates of service.
"So it isn't truly anonymized, but it's significantly reduced in terms of any risk," Bellin says. He notes that even this level of access requires permission from a clinical director, division head or other high-ranking administrator. In addition, anyone using the system must complete training in how to protect the security of the limited data set and anyone accessing the system via the Internet must show that he or she can encrypt information.
Given those safeguards, the IRB determined that work done in the restricted mode did not require IRB preapproval, Bellin says.
The second level, privileged mode, gives the user access to patient identifiers. In order to access that mode, the user must give an approval number from the IRB or from the performance improvement officer, depending upon whether the activity has been designated as research or quality improvement.
Hatcher says the IRB conducts quarterly audits to ensure that users who have submitted an IRB number actually have the necessary approval and that it hasn't expired.
"We often find that people put in the wrong numbers, the usual things when you have a computerized system," he says.
Bellin says most of the use of CLG is in the restricted mode. For example, a researcher wanting to study a particular disease could use that mode to look at how many patients have been diagnosed with it, or to ask some basic questions in preparation for submitting a protocol to the IRB.
"In fact you can see almost all work is done in the restricted mode, and only at the last moment, when there's an absolute need to know, do people actually pull the identifiers," he says. "If you give people the opportunity to do the right thing, and also give them the capacity to do almost all the analysis without having the identifiers and to easily flip it to an identified group with permission, there's no reason to cheat."
Enabling research
While most of the use of CLG is for quality improvement, Bellin says it's opened up research to many physicians who might not have considered it otherwise. For example, all of Montefiore's medical residents for the past three years have been trained to use it.
Without such a system, Bellin says, research is restricted to a much smaller group of investigators who have the ability to pull together enough information to submit to the IRB.
"We've made it possible for you to find out at least whether the question is in principle answerable," he says. "Once you have that in place, you're energized to go to the next step, to find a faculty mentor, to go to the IRB, to put together the proposal."
He says that while CLG hasn't lessened the IRB's workload, it has improved the quality of the proposals that make it to the board, by giving researchers the tools to better explore the question before submitting.
"So I don't know that it reduces the workload, but I think it matures that workload to a different level."
Improving ease of access to potential research data while aggressively protecting identifiable patient information it's a goal that many institutions struggle with.You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content