The Legal Pitfalls of Using a PDF Chart Summary or Cold Storage as a Healthcare Data Archiving Strategy

The following is a guest blog post by Justin Campbell, Vice President, Strategy, at Galen Healthcare Solutions.

When decommissioning healthcare systems to archive legacy data, there are often significant tradeoffs. For example, sacrificing fidelity (how well the original shape and precision of the data is preserved) for accessibility (how easy it is to get at the needed information). Another trade-off may compromise simplicity to gain greater accessibility.

To limit cost and effort, many healthcare delivery organizations make the backup of raw data from their various databases and file systems their formal archival strategy, or they load PDF chart summaries warehoused in a file store into a document management system. Such approaches are often determined by anticipated activity, frequency of access, or necessity to be compliant with legal requirements.

There are situations in which this may be good enough, such as when the source system is not so much being retired as it is being upgraded or still maintained. Another scenario in which this approach to archiving might suffice may be when the data in question comes from systems so well known that the organization won’t have significant issues retrieving it when necessary. However, this type of fragmented and incomplete archiving approach can hinder the organization’s ability to satisfy requests for the release of information within an allotted window of time. And that may increase the risk of e-Discovery liability.

The Flaws of using Cold Storage/Raw Data Backup as a Healthcare Data Archiving Strategy

While a cold storage or raw data backup archiving approach is flawed in its ability to provide accessibility and continuity of care, it can be effective in accessing infrequent requests for data in compliance reviews, or for occasional or ad-hoc reports. The greatest benefit to this approach is the ease with which the data can be acquired from the source system. Underlying data stores almost always offer uncomplicated built-in backup mechanisms. Indeed, the ability to back up data is a certification obligation for EMRs, as well as a HIPAA and HITECH legal requirement. This strategy also offers “perfect” data fidelity, because the data exists in the raw, original format.

But once it becomes necessary to access the “archived” data, the organization will have to fully reverse-engineer the underlying database schemas and file system encodings. This generates mammoth costs and protracted timelines for even the simplest data visualization, and would be a major undertaking if it also attempted to deliver significant direct clinician or compliance access to data.

Furthermore, the healthcare industry has stringent data access regulations. Protocols must be in place to strictly limit who can access the data, and audit trails need to record any time the data is accessed. Cold storage and raw data backup archiving strategies are ill-equipped to meet those needs.

Another hurdle associated with raw database backups is presented by the licensing language many clinical system vendors use in the “reverse engineering” of their products. So while it may be “your” data, the vendor may consider their schema intellectual property — and the act of deciphering it, not to mention keeping a copy of it after the licensing agreements with the system vendor have been terminated — may well be a direct violation of the original licensing agreement.

Using a PDF Chart Summary as an Archived Medical Record Comes with Significant Legal Peril

Many organizations perceive a Non-Discrete Indexed Document approach to healthcare data archiving as a cost-effective strategy for decommissioning legacy systems. However, the upfront costs saved are often outweighed by indirect costs incurred because the extraction of non-discrete clinical data requires tedious, time-consuming navigation. This approach commonly entails a PDF export of data in a pre-rendered format suitable for direct consumption. But PDFs are by themselves difficult to discover, as they’re almost always imported into a document management system along with associated metadata. This metadata is used to index the PDFs so they can be more easily retrieved by end-users. However, the data inside the document is not stored in a way that easily allows for discrete data operations. Data is viewed in an all-or-nothing manner, with no easy ability to sort or filter.

This method is particularly popular with organizations that already use a document management system, especially one well-integrated with clinical and other supporting systems. In those circumstances, there can be seamless access to the archived data. It may also be effective at capturing data from practice management systems though that can be more problematic because of requirements that financial data be exported in Excel reports. A PDF export is not well-suited for this.

In some cases, no separate document management system is utilized, and, instead, the data is loaded directly into the new electronic healthcare record system. This reasonably satisfies scenarios of clinical continuity.

Unless the source system can export data natively as a PDF or other type of pre-rendered document, substantial up-front implementation cost and time is usually involved in extracting the data and rendering it. The PDF output has a particular layout and shape, and this can be thought of as a model that must achieve a normalized format. Even in cases where the source system is capable of producing this output, there are often significant limitations as to what data is included. For example, It is common for imaging data to be excluded in the output of the documents, thereby requiring a separate strategy.

Lastly, the documents rarely take account of version history information, making it difficult to handle certain legal scenarios. Auditing data would typically also not be included in most PDF exporting capabilities, so, like imaging data, auditing data would require another archival strategy. This further complicates legal scenarios, as it’s frequently necessary to correlate patient chart data with audit trails. Having these archives disconnected makes such a process even more challenging, further limiting the effectiveness of this strategy alone as a compliant legal archive.

Preserve the Integrity and Completeness of the Original Record when Decommissioning Legacy Systems to Reduce Risk and Mitigate Liability

An organization’s ability to preserve the integrity and completeness of the original record, especially the ability to recreate a copy of the record as it existed at the relevant time in question, may be compromised when legacy systems are decommissioned, and legacy data is archived. This is especially trying because litigation and investigations can span several years, requiring a search for data contained in multiple EMR and/or legacy systems.

EMRs are a treasure trove of information, containing rich and deep data including patient demographics, symptoms, vital signs, medical diagnoses, treatments, progress notes, medications, immunizations, past medical history, laboratory data, care plans, and more. As such, the data contained in the EMR can reveal the standard of care and demonstrate consistency (or inconsistency) in treatment and policy application. The challenge to organizations is exacerbated by the fact that not all healthcare data archiving solutions are designed to manage the rigors of e-Discovery and may lack critical capabilities and controls to reduce risk.

The ability to offer robust legal and clinical archives can be greatly affected by approaches to extraction, transformation, loading and storage of data. A best-practice, risk-averse approach is to provide the same level of access for all archived systems and data sets. SaaS-native healthcare data archiving platforms designed from the ground up for the cloud are well suited to a cost-effective approach to the storage of legacy data without compromising accessibility or risking liability.

Want to learn more about the legal challenges with archiving legacy systems in healthcare? Download the full whitepaper, Legal Considerations for Healthcare Data Archiving, which covers the many legal considerations to evaluate when navigating the complex data structure and data sets, legal and compliance requirements, and continuity of care requirements that characterize effective healthcare legacy application retirement.

About Justin Campbell
Justin is Vice President, Strategy, at Galen Healthcare Solutions. He is responsible for market intelligence, segmentation, business and market development and competitive strategy. Justin has been consulting in Health IT for over 12 years, guiding clients in the implementation, integration and optimization of clinical systems. He has been on the front lines of system replacement and data migration, and is passionate about advancing interoperability in healthcare and harnessing analytical insights to realize improvements in patient care. Justin can be found on Twitter at @TJustinCampbell and LinkedIn.

About Galen Healthcare Solutions
Galen Healthcare Solutions is an award-winning, KLAS-ranked healthcare IT technical and professional services and solutions company providing high-skilled, cross-platform expertise and proud sponsor of the Healthcare Data Archiving Series. For over a decade, Galen has partnered with specialty practices, hospitals, health information exchanges, health systems and integrated delivery networks to provide data conversion and archival solutions. Galen has competed over 500 successful data conversion & archiving projects and has experience with over 100 unique systems. Their archiving solution, VitalCenter Online, was recognized by KLAS in their inaugural report, Legacy Data Archiving 2019 A First Look at a Changing Market, for the accuracy and accessibility of its data and for its industry-leading commitment to customer experience. The report showed that “Galen has the highest percentage of customers who report high satisfaction” with a tool that is “exceptionally easy to use” for keeping patient data in context. For more information, visit Connect with us on TwitterFacebook and LinkedIn.