HIM 400 Module 3 Data Extraction Short Paper Example

Two Requests, One Registry: Extracting Diabetes Data at Cold Brook Health

[Student Name]

Southern New Hampshire University

HIM 400: Communication and Technologies II

Module Three Short Paper

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Two Requests, One Registry: Extracting Diabetes Data at Cold Brook Health

In the same week, Cold Brook Health's informatics team received two requests for diabetes data. The nurse care managers asked for a list of adults whose diabetes is poorly controlled so they can call them before winter. A research group at a state university asked for registry data to study how travel distance affects diabetes control in rural Maine. Both requests draw on the relational registry designed in Module Two, but they differ in purpose, recipient and legal basis. This paper shows how each is specified, extracted, checked and released.

Turning a Request Into a Specification

"Patients with high A1c" is not a query. Before writing any code, the analyst met with the care manager lead and wrote a specification that states every rule. The population is patients aged 18 to 75 on the last day of the measurement period who meet the registry's diabetes definition and were seen by a Cold Brook primary care clinician during the prior twelve months. The measure is the most recent HbA1c in that twelve-month window. A patient is flagged if that value is above 9.0% or if no HbA1c was done at all, because an untested patient is as much at risk as a poorly controlled one. Patients enrolled in hospice or receiving palliative care are excluded, and the list must show each patient's practice, care manager, phone number, latest value and date.

These rules mirror the structure of the national quality measure for poor HbA1c control, which helps the team compare its list with the rates it reports. Writing them down also exposed a disagreement: the care managers had assumed a fifteen-month look-back, so their own counts had never matched the quality report.

Writing the Query

The query works in steps. A first step selects registry patients in the age range with a qualifying visit. A second step finds each patient's latest HbA1c in the window by ranking results by collection date within each patient and keeping the first. A third step removes patients with a hospice or palliative care code. The final step joins practice, care manager and contact fields and applies the flag. Table 1 summarizes each clause and what it does.

Table 1. Query Clauses for the Outreach List

Note. Logic written by the author for Cold Brook Health's registry schema.

Validating the Output

The first run returned 1,902 patients, 28% of the 6,794 in the denominator. Before release, the analyst compared a random sample of 50 flagged patients with their full charts. Eleven had an HbA1c recorded somewhere the query could not see: six in scanned outside lab reports, three typed into visit notes and two sent to the old workbook but never entered in the record.

Published studies found the same problem at larger scale. Parsons et al. (2012) compared quality measures calculated from electronic record data with manual chart review in primary care practices and found that electronic measures often underestimated performance, largely because the needed information was documented in places the reporting query did not capture. Kern et al. (2013) reached a similar conclusion at a federally qualified health center, where agreement between electronic and manual measurement varied widely across measures. For Cold Brook, the lesson is that a flagged patient is a candidate for outreach, not a verdict, so the list now includes a column noting whether an outside result is pending entry.

Releasing the Outreach List

The outreach list supports treatment and care coordination by Cold Brook's own staff, so identifiable data may be used. HIPAA's minimum necessary standard exempts disclosures to providers for treatment, but Cold Brook's role-based access policy follows the same principle, so it still shapes the output: the list contains the fields needed to call and schedule patients and nothing more, so diagnoses beyond diabetes, insurance details and addresses are left out. The list is posted to the care management folder, which only care managers can open, and replaced each month instead of emailed.

Answering the Research Request

The university request is different. Research is not treatment, and the investigators are outside the organization. HIPAA offers several paths: patient authorization, a waiver from an institutional review board, fully de-identified data or a limited data set released under a data use agreement. The study needs dates of HbA1c tests and the patient's town to estimate travel distance, and de-identification under the Safe Harbor method would remove both, since it strips dates other than year and most geographic units smaller than a state. A limited data set may keep dates and town or ZIP code while removing direct identifiers such as names, phone numbers, street addresses and record numbers.

The analyst therefore prepared a limited data set containing a study identifier, age, sex, town, ZIP code, test dates, HbA1c values and visit counts. The release waits until the university signs a data use agreement promising not to re-identify or contact patients, to use the data only for the approved study and to report any breach.

Re-identification Risk

Removing names does not make rural data anonymous. In a town of 900 residents, a 43-year-old woman with type 1 diabetes may be the only one. El Emam et al. (2011) reviewed published re-identification attacks on health data and found that most successful attacks involved data that had not been de-identified to existing standards, and that re-identification rates were low when those standards were followed, although the evidence base was small. Their findings support the safeguards Cold Brook chose: the agreement forbids re-identification, ages above 89 are grouped and town counts below 11 patients are combined with a neighboring town before release.

Conclusion

The two requests used the same tables but produced two different releases. The outreach list is identifiable, limited to what care managers need and validated against charts. The research file is a limited data set with small counts combined and an agreement in place. In both cases the most important work happened before the query ran: turning a request into written rules and deciding who may see what.

References

El Emam, K., Jonker, E., Arbuckle, L., & Malin, B. (2011). A systematic review of re-identification attacks on health data. PLoS ONE, 6(12), Article e28071. https://doi.org/10.1371/journal.pone.0028071

Kern, L. M., Malhotra, S., Barrón, Y., Quaresimo, J., Dhopeshwarkar, R., Pichardo, M., Edwards, A. M., & Kaushal, R. (2013). Accuracy of electronically reported "meaningful use" clinical quality measures: A cross-sectional study. Annals of Internal Medicine, 158(2), 77-83. https://doi.org/10.7326/0003-4819-158-2-201301150-00001

Parsons, A., McCullough, C., Wang, J., & Shih, S. (2012). Validity of electronic health record-derived quality measurement for performance monitoring. Journal of the American Medical Informatics Association, 19(4), 604-609. https://doi.org/10.1136/amiajnl-2011-000557