Healthcare Informatics Skill
Clinical terminology, healthcare compliance (HIPAA/HITECH), patient safety, and health data management.
Core Principle
Healthcare information systems exist to improve patient outcomes. Every data decision balances access (clinicians need information) against privacy (patients deserve protection). When in doubt, protect the patient.
HIPAA Compliance
Protected Health Information (PHI)
PHI is any individually identifiable health information. The 18 HIPAA identifiers:
| # |
Identifier |
Example |
| 1 |
Names |
Full name |
| 2 |
Geographic data |
Address, ZIP (3-digit OK if population >20K) |
| 3 |
Dates |
DOB, admission, discharge, death (year OK) |
| 4 |
Phone numbers |
All |
| 5 |
Fax numbers |
All |
| 6 |
Email addresses |
All |
| 7 |
SSN |
All |
| 8 |
Medical record numbers |
All |
| 9 |
Health plan beneficiary numbers |
All |
| 10 |
Account numbers |
All |
| 11 |
Certificate/license numbers |
All |
| 12 |
Vehicle identifiers |
VIN, plates |
| 13 |
Device identifiers/serial numbers |
All |
| 14 |
Web URLs |
All |
| 15 |
IP addresses |
All |
| 16 |
Biometric identifiers |
Fingerprints, voice |
| 17 |
Full-face photographs |
All |
| 18 |
Any other unique identifying number |
All |
De-identification Methods
| Method |
Approach |
Use When |
| Safe Harbor |
Remove all 18 identifiers |
Standard approach, lower risk |
| Expert Determination |
Statistical/scientific analysis |
Need richer dataset, qualified expert available |
Minimum Necessary Standard
- Use or disclose only the minimum PHI necessary for the purpose
- Role-based access controls in EHR systems
- Audit logs for every PHI access
HITECH Act Extensions
| Requirement |
Detail |
| Breach notification |
60 days for breaches affecting 500+ individuals |
| Business Associate liability |
BAs directly liable for HIPAA violations |
| Audit trail |
All access to electronic PHI must be logged |
| Encryption safe harbor |
Encrypted data breach = not a reportable breach |
FHIR Patient Resource Example
{
"resourceType": "Patient",
"id": "example",
"identifier": [
{
"system": "http://hospital.org/mrn",
"value": "12345"
}
],
"name": [
{
"use": "official",
"family": "Doe",
"given": ["John"]
}
],
"gender": "male",
"birthDate": "1985-06-15",
"address": [
{
"use": "home",
"city": "Springfield",
"state": "IL",
"postalCode": "62704"
}
]
}
Clinical Terminology Standards
Key Coding Systems
| System |
Purpose |
Example |
| ICD-10 |
Diagnosis codes |
E11.9 (Type 2 diabetes without complications) |
| CPT |
Procedure codes |
99213 (Office visit, established patient) |
| SNOMED CT |
Clinical terms |
73211009 (Diabetes mellitus) |
| LOINC |
Lab/observation codes |
2345-7 (Glucose, serum/plasma) |
| RxNorm |
Medications |
Metformin 500mg oral tablet |
| NDC |
Drug packaging |
10-digit national drug code |
Interoperability Standards
| Standard |
Role |
| HL7 FHIR |
RESTful API for health data exchange |
| HL7 v2 |
Legacy messaging (ADT, ORM, ORU) |
| CDA/C-CDA |
Structured clinical documents |
| DICOM |
Medical imaging format and protocol |
| X12 EDI |
Insurance claims (837), eligibility (270/271) |
Electronic Health Records (EHR)
Core EHR Functions
- Clinical Documentation — Progress notes, assessments, plans
- CPOE — Computerized Provider Order Entry (meds, labs, imaging)
- CDS — Clinical Decision Support (alerts, reminders, pathways)
- Results Management — Lab values, imaging reports
- Medication Management — e-Prescribing, interaction checks, reconciliation
Patient Safety Checks
| Check |
Purpose |
| Drug-drug interactions |
Prevent harmful combinations |
| Drug-allergy alerts |
Match known allergies |
| Dose range checking |
Flag outlier dosages |
| Duplicate order detection |
Prevent redundant tests/meds |
| Clinical pathway adherence |
Evidence-based care protocols |
Healthcare Data Analytics
Quality Measures
| Measure Type |
Example |
Source |
| Process |
% of diabetics with annual HbA1c |
HEDIS |
| Outcome |
30-day readmission rate |
CMS |
| Patient Experience |
HCAHPS survey scores |
CMS |
| Structure |
EHR adoption rate, nurse-to-patient ratio |
Various |
Risk Adjustment
- HCC (Hierarchical Condition Categories) for Medicare risk scoring
- Comorbidity indices (Charlson, Elixhauser) for severity adjustment
- Social Determinants of Health (SDOH) as contextual factors
Research & Clinical Trials
IRB Requirements
| Element |
Requirement |
| Informed consent |
Written, plain language, voluntary |
| Risk minimization |
Reasonable procedures, minimal risk where possible |
| Privacy protections |
De-identification or limited datasets |
| Vulnerable populations |
Extra safeguards for children, prisoners, pregnant women |
Clinical Trial Phases
| Phase |
Purpose |
Size |
| Phase I |
Safety, dosage |
20–100 |
| Phase II |
Efficacy, side effects |
100–300 |
| Phase III |
Confirm efficacy, monitor adverse |
1,000–3,000 |
| Phase IV |
Post-market surveillance |
Thousands |
AI in Healthcare — Guardrails
Critical: AI-generated medical information must never be presented as clinical advice.
- Always include disclaimer: "This is informational only. Consult a healthcare professional."
- Never diagnose or recommend treatment
- Flag when confidence is low or data is ambiguous
- Cite clinical guidelines (USPSTF, ACC/AHA, IDSA) when referencing evidence-based practices
- Document provenance of any clinical data used in analysis
1---2name: healthcare-informatics3description: Clinical terminology, healthcare compliance (HIPAA/HITECH), patient safety, and health data management.4---5
6# Healthcare Informatics Skill
7
8> Clinical terminology, healthcare compliance (HIPAA/HITECH), patient safety, and health data management.
9
10## Core Principle
11
12Healthcare information systems exist to improve patient outcomes. Every data decision balances access (clinicians need information) against privacy (patients deserve protection). When in doubt, protect the patient.
13
14## HIPAA Compliance
15
16### Protected Health Information (PHI)
17PHI is any individually identifiable health information. The 18 HIPAA identifiers:
18
19| # | Identifier | Example |
20|---|-----------|---------|
21| 1 | Names | Full name |
22| 2 | Geographic data | Address, ZIP (3-digit OK if population >20K) |
23| 3 | Dates | DOB, admission, discharge, death (year OK) |
24| 4 | Phone numbers | All |
25| 5 | Fax numbers | All |
26| 6 | Email addresses | All |
27| 7 | SSN | All |
28| 8 | Medical record numbers | All |
29| 9 | Health plan beneficiary numbers | All |
30| 10 | Account numbers | All |
31| 11 | Certificate/license numbers | All |
32| 12 | Vehicle identifiers | VIN, plates |
33| 13 | Device identifiers/serial numbers | All |
34| 14 | Web URLs | All |
35| 15 | IP addresses | All |
36| 16 | Biometric identifiers | Fingerprints, voice |
37| 17 | Full-face photographs | All |
38| 18 | Any other unique identifying number | All |
39
40### De-identification Methods
41| Method | Approach | Use When |
42|--------|----------|----------|
43| **Safe Harbor** | Remove all 18 identifiers | Standard approach, lower risk |
44| **Expert Determination** | Statistical/scientific analysis | Need richer dataset, qualified expert available |
45
46### Minimum Necessary Standard
47- Use or disclose only the minimum PHI necessary for the purpose
48- Role-based access controls in EHR systems
49- Audit logs for every PHI access
50
51## HITECH Act Extensions
52
53| Requirement | Detail |
54|------------|--------|
55| Breach notification | 60 days for breaches affecting 500+ individuals |
56| Business Associate liability | BAs directly liable for HIPAA violations |
57| Audit trail | All access to electronic PHI must be logged |
58| Encryption safe harbor | Encrypted data breach = not a reportable breach |
59
60### FHIR Patient Resource Example
61
62```json
63{
64 "resourceType": "Patient",
65 "id": "example",
66 "identifier": [
67 {
68 "system": "http://hospital.org/mrn",
69 "value": "12345"
70 }
71 ],
72 "name": [
73 {
74 "use": "official",
75 "family": "Doe",
76 "given": ["John"]
77 }
78 ],
79 "gender": "male",
80 "birthDate": "1985-06-15",
81 "address": [
82 {
83 "use": "home",
84 "city": "Springfield",
85 "state": "IL",
86 "postalCode": "62704"
87 }
88 ]
89}
90```
91
92## Clinical Terminology Standards
93
94### Key Coding Systems
95| System | Purpose | Example |
96|--------|---------|---------|
97| **ICD-10** | Diagnosis codes | E11.9 (Type 2 diabetes without complications) |
98| **CPT** | Procedure codes | 99213 (Office visit, established patient) |
99| **SNOMED CT** | Clinical terms | 73211009 (Diabetes mellitus) |
100| **LOINC** | Lab/observation codes | 2345-7 (Glucose, serum/plasma) |
101| **RxNorm** | Medications | Metformin 500mg oral tablet |
102| **NDC** | Drug packaging | 10-digit national drug code |
103
104### Interoperability Standards
105| Standard | Role |
106|----------|------|
107| **HL7 FHIR** | RESTful API for health data exchange |
108| **HL7 v2** | Legacy messaging (ADT, ORM, ORU) |
109| **CDA/C-CDA** | Structured clinical documents |
110| **DICOM** | Medical imaging format and protocol |
111| **X12 EDI** | Insurance claims (837), eligibility (270/271) |
112
113## Electronic Health Records (EHR)
114
115### Core EHR Functions
1161. **Clinical Documentation** — Progress notes, assessments, plans
1172. **CPOE** — Computerized Provider Order Entry (meds, labs, imaging)
1183. **CDS** — Clinical Decision Support (alerts, reminders, pathways)
1194. **Results Management** — Lab values, imaging reports
1205. **Medication Management** — e-Prescribing, interaction checks, reconciliation
121
122### Patient Safety Checks
123| Check | Purpose |
124|-------|---------|
125| Drug-drug interactions | Prevent harmful combinations |
126| Drug-allergy alerts | Match known allergies |
127| Dose range checking | Flag outlier dosages |
128| Duplicate order detection | Prevent redundant tests/meds |
129| Clinical pathway adherence | Evidence-based care protocols |
130
131## Healthcare Data Analytics
132
133### Quality Measures
134| Measure Type | Example | Source |
135|-------------|---------|--------|
136| **Process** | % of diabetics with annual HbA1c | HEDIS |
137| **Outcome** | 30-day readmission rate | CMS |
138| **Patient Experience** | HCAHPS survey scores | CMS |
139| **Structure** | EHR adoption rate, nurse-to-patient ratio | Various |
140
141### Risk Adjustment
142- HCC (Hierarchical Condition Categories) for Medicare risk scoring
143- Comorbidity indices (Charlson, Elixhauser) for severity adjustment
144- Social Determinants of Health (SDOH) as contextual factors
145
146## Research & Clinical Trials
147
148### IRB Requirements
149| Element | Requirement |
150|---------|------------|
151| Informed consent | Written, plain language, voluntary |
152| Risk minimization | Reasonable procedures, minimal risk where possible |
153| Privacy protections | De-identification or limited datasets |
154| Vulnerable populations | Extra safeguards for children, prisoners, pregnant women |
155
156### Clinical Trial Phases
157| Phase | Purpose | Size |
158|-------|---------|------|
159| Phase I | Safety, dosage | 20–100 |
160| Phase II | Efficacy, side effects | 100–300 |
161| Phase III | Confirm efficacy, monitor adverse | 1,000–3,000 |
162| Phase IV | Post-market surveillance | Thousands |
163
164## AI in Healthcare — Guardrails
165
166**Critical**: AI-generated medical information must never be presented as clinical advice.
167- Always include disclaimer: "This is informational only. Consult a healthcare professional."
168- Never diagnose or recommend treatment
169- Flag when confidence is low or data is ambiguous
170- Cite clinical guidelines (USPSTF, ACC/AHA, IDSA) when referencing evidence-based practices
171- Document provenance of any clinical data used in analysis