EMRs, Data Mining and HIPAA | [node:field-byline] | Healthcare Blogs Skip to content Skip to navigation

EMRs, Data Mining and HIPAA

March 27, 2008
by Reece Hirsch
| Reprints

The current Healthcare Informatics online poll asks whether you would contract with an electronic medical record vendor that had an arrangement with a third party to mine EMR data for research or other purposes. It's important to remember in these situations that an EMR vendor will typically be a business associate of a healthcare provider within the meaning of HIPAA. A compliant business associate agreement must "establish the permitted and required uses and disclosures" of protected health information (PHI) by the business associate. In short, an EMR vendor can share information only to the extent that it has been permitted to do so under the terms of its business associate (BA) agreement.

BA agreements may contain optional provisions permitting "data aggregation" services, "de-identification" of PHI and use for the "proper management and administration" of the business associate. "Data aggregation" and "de-identification" have defined meanings under the HIPAA Privacy Rule. It's a little more unclear how far a vendor may go in using PHI for its own "proper management and administration" purposes. HIPAA covered entities should never sign a BA agreement with an EMR vendor (or any other vendor, for that matter) without watching for these key phrases and understanding fully how the vendor intends to use and disclose their PHI.

The Health IT Summits gather 250+ healthcare leaders in cities across the U.S. to present important new insights, collaborate on ideas, and to have a little fun - Find a Summit Near You!


See more on