Does HIPAA Apply to Your App?

There has been lots of confusion in the marketplace regarding when the Health Insurance Portability and Accountability Act, or HIPAA (one 'p' and two 'a's), should apply to mobile apps. You can read more about HIPAA here.

Typically, confusion ≠ innovation.

Recently the Department of Health and Human Services released a new website targeted at mobile health app developers via the Office of Civil Rights. This site was intended to open a dialog regarding issues relevant to mHealth developers, and one of the issues likely raised by many was the applicability of HIPAA. In response to this, they recently updated the site with additional guidance, found here.

This document, only a few pages long, helps to clarify a number of issues through relevant examples. The questions it attempts to address are:

1. How does HIPAA apply to health information that a patient creates, manages or organizes through the use of a health app?
2. When might an app developer need to comply with the HIPAA rules?

Please refer to the document for all the detail (and it makes clear that a slight change in the facts of a situation may change the applicability), but here are some highlights:

"A consumer downloads a health app to her smartphone. She populates it with her own information."

Developer is NOT a HIPAA Business Associate.

"Consumer downloads a health app to her smartphone that is designed to help her manage a chronic condition. She downloads data from her doctor's EHR through a patient portal, onto her computer and then uploads it into the app. She also adds her own information to the app."

Developer is NOT a HIPAA Business Associate.

"Doctor counsels patient that his BMI is too high, and recommends a particular app that tracks diet, exercise, and weight. Consumer downloads app to his smartphone and uses it to send a summary report to his doctor before his next appointment."

Developer is NOT a HIPAA Business Associate.

"Consumer downloads a health app to her smartphone that is designed to help her manage a chronic condition. Health care provider and app developer have entered into an interoperability arrangement at the consumer’s request that facilitates secure exchange of consumer information between the provider EHR and the app. The consumer populates information on the app and directs the app to transmit the information to the provider’s EHR. The consumer is able to access test results from the provider through the app. "
Developer is NOT a HIPAA Business Associate.

In all of these cases, the developer is not a HIPAA Business Associate because the developer is not creating, receiving, maintaining or transmitting protected health information (PHI) on behalf of a covered entity or another business associate. That last piece is the key. The consumer made the choice to take these actions, and the consumer has the right to do what she wants with this information.

This last example is also what would likely apply when a consumer chooses to make use of Apple's HealthKit, which we have been using for over a year here at Duke. The way it's set up here, even when a physician makes a recommendation to have a consumer share his/her information in order to facilitate care, the consumer can choose to do so manually via MyChart or via HealthKit. HealthKit is never required - it's the consumer's choice.

There are two additional examples in the document regarding cases when the developer would be a business associate. Those include the following:

"At direction of her provider, patient downloads a health app to her smart phone. Provider has contracted with app developer for patient management services, including remote patient health counseling, monitoring of patients’ food and exercise, patient messaging, EHR integration and application interfaces. Information the patient inputs is automatically incorporated into provider EHR."

"Consumer downloads to her smart phone a mobile PHR app offered by her health plan that offers users in its network the ability to request, download and store health plan records and check the status of claims and coverage decisions. The app also contains the plan’s wellness tools for members, so they can track their progress in improving their health. Health plan analyzes health information and data about app usage to understand effectiveness of its health and wellness offerings. App developer also offers a separate, direct- to-consumer version of the app that consumers can use to store, manage, and organize their health records, to improve their health habits and to send health information to providers."

Hopefully this helps provide a little clarity regarding when HIPAA is relevant. If you have additional questions, I suggest submitting them to the mHealth HIPAA site referenced above.

ResearchKit is Official at Duke: Autism & Beyond

Over the past 6 months there's been something brewing at Duke ... something that we're now incredibly excited to share with the world.

But first, a bit of background:

• 1 in 68 children will be diagnosed with Autism
• Autism can be diagnosed as young as 18 months old
• The average age of Autism diagnosis in the US is over 5 years old
• A child's brain will grow at a rate of 700 synapses/sec in the first years of life
• 70 counties in NC have no access to a childhood mental health specialist
• In Africa, where there are approximately 500 million children, there are only about 50 childhood mental health specialists

Do you detect a need?

We do, too.

Thus, Autism & Beyond was born. Autism & Beyond is an incredible new ResearchKit study that builds upon the groundbreaking work of Geri Dawson, Helen Egger and Guillermo Sapiro, who over the past several years have been working to refine novel video algorithms that can analyze and detect a child's emotion in real-time. They've been conducting studies at Duke clinics using an iPad prototype app for almost 2 years.

In early 2014 I had the pleasure of working with Kathleen Campbell, a wonderful 2nd-year medical student on her inpatient Pediatrics clerkship. I was her attending physician at the time. Shortly thereafter, and knowing I had an interest in mobile technology, she gave me a demo of an app that the aforementioned team had put together. The idea and technology were amazing. I thought it was great work, although I really had nothing to add at the time. I looked forward to seeing the results of that research.

Fast forward to March 2015, and the announcement of ResearchKit. It was clear that we needed to put this technology to the test, and quickly. We cast a wide net looking for "shovel-ready" projects, and of course, the autism app Kathleen showed me bubbled to the top. The project was already underway (with an iOS app no less!), and had a great team that had already made significant strides in this area. It was an natural fit.

It was also a remarkable coincidence that at this exact time within the Duke Institute for Health Innovation (DIHI) we had just hired two talented mobile developers, Mike Revoir and Jamie Daniel, who were (are) passionate about mobile technology, health, and research. They were so excited about the project that they were eager to dive in even before their first official day of work! As the scope of the project grew, so did the number of individuals and teams involved. In the end, it was a peerless example of cross-institutional collaboration across Duke University and the Health System. This project couldn't have happened without any of them.

Autism & Beyond

So what about the actual app? I could explain it in detail here, but seeing is believing, so go download it now! And if you want more info, check out the website. Even if you don't meet the eligibility criteria, we've made it simple to get a taste of the cool technology that's gone into it without ever signing up.

    

The app basically comes down to our need to know one thing: could we one day use a mobile phone to automate screening for conditions such as autism or anxiety? To start, we first need to know if it's even feasible to analyze facial expressions on such a small device. That's what this study is intended to determine: feasibility.

As you can see from the screenshot above, the software algorithms developed by Guillermo and his team not only detect facial features, but also expressions, and can do so in real time. The data from this study will help to refine those algorithms.

In addition to the facial recognition pieces, we've also included several critical questionnaires with the help of Helen and Geri. For example, we ask about temper tantrums and provide feedback to users regarding where their child falls compared to his/her peers.

Additionally, study participants will be able to see how many other families have enrolled as well as a few additional aggregate data points:

Check out the number of enrolled
participants in near real-time!

While the release of the app marks the end of one chapter (and a whole lotta work by our incredible team!), it's clearly just the beginning. We hope that the app will have an impact in the US, but also plan to roll it out in China and South Africa soon. The more children we can reach, the more we can help. While ResearchKit allows us to reach millions, we still need to take care of one child at a time, and ensure that those children have access to the resources they'll ultimately need for full diagnosis and treatment. That's going to take even more teamwork!

Duke's on FHIR (for real this time)!

In June I described our work to date on integrating the SMART and FHIR APIs into our Epic-based EHR.

As a recap, we started this process in 2014 with a custom Android app that pulled patient problems, medications and demographics directly from the EHR via simple REST-based APIs. As we became more familiar with SMART and FHIR, we realized the value in joining forces with a common standard. It was never our intention to create something that would only be useful to us, and it was clear that the momentum around FHIR was building.

Fast-forward to January 2015, when we had our first SMART apps running in our proof-of-concept environment. It could be done! We followed this with integration of several additional apps and a demo at HIMSS in Chicago. You've seen this before:

This was all fine and dandy, but it was still all in our proof-of-concept system with "fake" patient data.

Since that time our amazing development team, led by Felipe Polo-Wood, has been diligently working to move this infrastructure into our production environment, an important milestone in order to show that SMART and FHIR can do more than just play in the sandbox.

I'm happy to report that as of August 26, 2015, the infrastructure has been live for some Duke-specific internal use-cases. In fact, Felipe was so excited to share that I had a screenshot waiting in my inbox that morning, demonstrating that the systems were, indeed, calling the FHIR APIs, and that the transition was seamless from the outdated infrastructure FHIR was intended to replace:

Duke was officially on FHIR!

But not ones to rest on their laurels, the team immediately got to work to enable a more visible example of what FHIR can do: a true SMART-compatible app, Pediatric Growth Chart.

Drumroll ...

On October 9, 2015 I successfully logged into our production system for the first time to view real patient data in a FHIR app! I'd love to share screenshots with you, but they contain real patient data, so I can't! Let me say that again: real patient data, via FHIR, within Maestro Care, our Epic-based EHR.

And, of course, the best is yet to come!

Kudos to Felipe and the rest of the incredible CATS development team for making this happen. It has truly been a team effort, and I know they share the same enthusiasm for this project as I do, because they're always smiling!

The incredible CATS team:

• Felipe Polo-Wood (Señor Manager)
• Vince Guaglione
• Lusia Li
• Luiz Omori
• Carrie Porterfield

White House Champions of Change in Precision Medicine: Duke's Commitment

Today I had an opportunity today to attend a White House event highlighting work in the field of precision medicine. I was joined by my colleague Geoff Ginsburg who directs the Duke Center for Personalized and Precision Medicine (video replay here, with Geoff's comments at 2:08:30). As part of the event, Duke was highlighted for our commitment to precision medicine. This was for two reasons:

• The innovative MeTree platform created by Geoff, Lori Orlando and the rest of the MeTree team. This platform provides a way for patients to work together with their doctors to improve the recording of their detailed family health history - information that is critical to the success of precision medicine.
• The fact that the MeTree platform will be integrated into our Epic-based EHR using SMART on FHIR. Duke is an "Implementer" of the Argonaut Project, and was the first health system with an Epic-based EHR to run unmodified SMART apps directly (see our HIMSS demonstration video here).

As I've said elsewhere, we're on the verge of a renaissance in healthcare technology modularity and interoperability, led by open and familiar standards. The same principles that have led to the successful mobile app ecosystem are being applied to healthcare, with the result that many more innovators will have access to tools that allow them to build EHR-compatible apps. The problems in healthcare are enormous, and the more brilliant minds we have focused on these problems, the more likely it is that we'll find compelling solutions, and soon.

Geoff shared a few comments with the group at the event today, which I've shared here with his permission:

Good afternoon. My name is Geoff Ginsburg and I direct the Duke University Center for Applied Genomics and Precision Medicine. 

It is an honor for our work to be recognized at this Champions for Change for Precision Medicine event. I want to acknowledge up front the support of the Duke Health System, of my colleague Ricky Bloomfield (Director of Mobile Technology Strategy and hospitalist at Duke) who is in the audience and of Lori Orlando (a health services researcher and internist at Duke) who could not be here today but who has been key to the development of this idea and making it real. 

Today we are announcing the development of a platform that will make it easier for the patient to provide information about their family history to their provider and for providers to access family history and risk information to better care for their patients
 -- information that is critical to precision medicine. 

Several years ago we recognized that family history is fundamental to optimizing effective clinical approaches to personalized and precision medicine. However, our research showed that seldom, if at all, was a patient’s family history captured and adequately documented by providers. Furthermore, when histories were taken, there were challenges in interpreting the risk information in a multigenerational family history.

How many of you in the audience have had a truly detailed family history taken by your doctor and learned something from the results?

To address this challenge we created a patient facing, web-based, evidence based software platform to capture family health history – called MeTree. Patients talk to their families and loved ones about what illnesses family members have had and their age of onset and enter the information via the web into our software platform. The information is used to calculate risks for developing disease and the results are reported back both to the provider and to the patient creating an effective provider-patient interaction about their hereditary health risks and what to do about them. 

Two years ago we were fortunate to be funded by National Human Genome Research Institute to expand the reach of this platform to five different health systems across the country representing a variety of care environments and demographic groups. 

Now thousands of patients are learning about their family history of disease and using that information with their providers to get appropriate screening, genetic counseling and testing and taking actions to enhance disease prevention. 

Duke is pioneering the use of open, vendor-neutral standards espoused by the Argonaut Project. These standards will be in place by year’s end to enable this platform to be integrated into multiple patient portals and EHRs, which will allow will near universal accessibility of family history information to patients and providers seamlessly --  improving shared decision making related to prevention of inherited disease. 

With commitment comes responsibility. We will now get to work to honor this commitment to the President and to our patients. It is our hope that this work will help facilitate many more innovations from health systems and technology companies in the future so that we can realize our shared goal of higher quality and more cost-effective healthcare in our country.

Duke's on FHIR (but it's ok)!

Current EHRs are among the most complex pieces of software ever written. They serve a critical role to help standardize clinical workflow, facilitate billing, and integrate simplistic forms of clinical decision support, yet tremendous effort is required to customize EHRs to meet the needs of diverse hospital systems.

We felt there had to be a better way.

Starting in 2012 we started investigating ways to create a framework built on top of our Epic-based EHR that would allow us to access the EHR in a standard way from any device or platform. By the summer of 2013 we had a functional proof of concept that allowed us to access patient demographics, problem lists, medications and more from a simple Android app. Duke Apps Supporting Healthcare, referred to internally as DASH, was born!

Around this same time, we started learning more about a similar effort underway at Boston Children’s Hospital called SMART (Substitutable Medical Apps and Reusable Technologist) that incorporated a new REST-based open API called FHIR (Fast Healthcare Interoperability Resources, supported by HL7). Since our goal was general ease of use and interoperability, it made sense to join this effort, originally funded by the ONC via the SHARP program. There were already several proof-of-concept apps written to be SMART on FHIR compliant, so from a practical standpoint, this made sense.

We updated our code to be compliant with both SMART and FHIR and as of January 2015 we became the first Epic-based hospital system to run unmodified SMART apps within our EHR (in our proof of concept environment).

We were thrilled to present this work at the HIMSS 2015 national conference, and you can view a sample the demonstration here (UI bits blurred at Epic's request):

In order to have a compelling demo, we wanted to show several types of apps running in multiple environments. We chose:

• Growth Chart, an open-source pediatric growth chart app with an award-winning interface
• Meducation RS, a closed-source app by Polyglot that presents a patient's medication list in simple language translated into 21 languages
• Duke PillBox, a skill-based interactive learning tool to help patients teach themselves how to take their medications as part of the discharge process. This was developed by MedAppTech for a Duke research initiative.

We demonstrated each of these apps running in both the Epic desktop environment as well as the Epic mobile apps for iOS. Once the infrastructure was in place, it took less than 5 minutes to add these SMART apps to our mobile EHR. Playing with FHIR has never been so fun (or easy)!

Finally, we also demonstrated a native iOS app, Pediatric Growth Charts, that we launched with the patient context from the Epic iOS app.

So, we demonstrated an open source app, a closed source app, and an internally-developed app all functional within desktop and mobile EHR environments, plus a native iOS app to boot. And we're just getting warmed up!

Probably the most frequent question I get is: How did you do it?

Answer: Very carefully.

Ok, so the real answer is that this was a development effort in the truest sense of the phrase. Prior to our switch to Epic, Duke had a home-growth EHR, which means we have some seriously talented developers here who know how to write production-grade EHR code. In this case, we were able to use many of the web services already provided by Epic and simply add a FHIR wrapper. Some data elements required a bit more work. To tie it all together, we wrote a rate-limiting and authorization server in Node.js and installed MITREid Connect to handle authentication.

Is this the path we'd recommend for everyone? No, probably not. Fortunately, most hospital systems won't have to write their own SMART on FHIR implementations. Through the Argonaut Project, many major EHR vendors and academic medical centers have committed to FHIR as well as the OAuth profiles needed to make it all work. This includes Epic. So hang tight, and your EHR vendor of choice will likely soon provide you the tools you need to kindle the flame.

Duke is involved in Argonaut as an "Implementer," which means we have real-world experience implementing apps that use the standard, and have provided feedback to improve both SMART and FHIR.

As I've said before, there probably hasn't been a more exciting time to work in healthcare technology. Between novel patient engagement tools such as HealthKit and Google Fit, cutting-edge research platforms such as ResearchKit, and now truly modern APIs that will usher in a new generation of substitutable EHR apps, there's plenty to keep us busy, and most importantly, to help patients take better care of themselves and providers take better care of patients.

And the best part? Things are just starting to heat up ...

The Apple Watch: Counting Calories Counts

I've now spent a few weeks with Apple Watch, and while there's a lot to talk about, one feature in particular has "surprised and delighted" me, and it's not the one I was expecting.

I exercise regularly, but I wasn't expecting Apple Watch to help me much with respect to my routine. That's not because I didn't think it would be accurate or easy to use, but simply because Apple Watch wasn't made for me: I'm a swimmer.

Granted, it's been shown that Apple Watch can withstand a good swim, but it's still not designed to track swimming (I use my Pebble with the swim.com app for that), and Apple specifically discourages it.

So rather than lament Apple Watch's neglect of swimmers the world over, I went for a walk. A few of them, actually (dog needs exercise, too). And what I saw surprised me. Check out the following two workouts that Apple Watch saved to the Health app. Notice anything interesting?

I did a double-take when I saw these results, but then it dawned on me what was going on, and it's super cool. If you noticed, the first workout was a 0.93 mile walk that lasted 17 minutes, during which I burned 66 calories. The second workout was only 0.91 miles, lasted only 14 minutes, yet I burned 72 calories!

So how could a shorter walk (both in distance and duration) lead to more calories burned? While you mull that over, take a few minutes to head over to ABC News to view a 5-minute video about Apple's secret fitness lab. I'll wait.

Wasn't that cool? Apple is amassing what is probably the world's largest and most complete set of physiologic data during exercise (over 18,000 hours and counting), all while volunteers wear Apple Watch. This testing takes multiple factors into account, including activity level (accelerometer), heart rate, temperature, and probably also factors in height and weight when available, although I don't have access to their algorithms to know for sure. The volunteers in the fitness lab also wear specialized (and very expensive) gear designed to accurately measure caloric expenditure. These data can then be used to create accurate data models to fit almost every profile, leading to an extremely accurate estimate of calories burned.

In other words, Apple is validating the watch to be the most accurate consumer-oriented calorie-counting machine ever created.

Of course, this explains the "discrepancy" in my workout numbers. In the second workout, I had to walk much quicker in order to cover 0.91 miles three minutes faster than the 0.93 miles I walked the day before. Apple Watch knew I was working harder because it was tracking my heart rate every 5 seconds for the duration of the workout, and my heart rate reflected the increased activity.

Lesson: to burn calories, nothing can replace good old-fashioned, heart-pumpin' aerobic exercise!

Want to know the coolest part? Measuring heart rate is just the beginning! As I've mentioned before, now that we have a computer in constant contact with our skin, the market for transcutaneous sensors is going to explode, and the more data we collect, the more accurate these measurements will be.

Just hurry it up with the swim tracking, ok, Apple?

ResearchKit is upon us!

Today, Apple has unveiled the open source code to their ResearchKit framework. You can find it here:

http://researchkit.github.io/

I was pleased to see the code hosted on GitHub, which I've found to be exceedingly user-friendly and which we already use here at Duke Medicine.

Also, not only has Apple released the code for ResearchKit itself, but they've also released the code for all 5 of the ResearchKit apps developed to date, as well as the back end code used for those apps, called AppCore. That's the power of open source, folks!

We've been discussing ResearchKit internally since it was announced in March. Anyone waiting for the code to be released before starting on their ResearchKit apps is already behind. Why? I'd estimate that over 90% of the effort required to create a ResearchKit app comes before a single line of code is written. The code itself is simple and straightforward, making it easy to create a consent workflow and make use of active tasks.

But the real work comes in designing the study itself. What do you want to study? Why? What is your target population? Who gets access to the data? How many versions of the consent do you need? Do you want it localized? US? International? Has it been approved by the IRB? The list goes on.

In my opinion, this is the future of research for a certain category of studies that require access to large numbers of individuals for more refined data, or that need access to a very specific and hard-to-reach patient population, such as one with a rare disease.

I've already spent too long on this blog post. Our developers are jumping into the framework as we speak, ready to begin our study implementation. Time to dig in!