Vital Signs

A risk assessment is the process of identifying, analyzing, and evaluating risks, and the report that summarizes an organization’s vulnerabilities, estimated costs of damage, and defensive measures. This post explains the HIPAA risk analysis requirement, how NIST Special Publication 800-30 structures the process, and what a 6,612-breach analysis, a scoping review of machine learning cybersecurity, and a review of medical device threats say about where risk is concentrated.

A knowledge base is a set of data tables, databases, and other tools that assist the process of care. This post explains how clinical knowledge bases feed decision support, what a comparison of three commercial drug interaction knowledge bases found, what a 2006 review concluded about errors in commercial prescribing systems, and what a primary care study showed when a decision support tool was ignored in 75 percent of encounters.

An interface is hardware or software designed to pass information between devices, between programs, or between a computer and a person. This post separates system interfaces, such as HL7 v2 feeds, from user interfaces, and explains what a scoping review of 28 studies found about how poorly designed EHR interfaces cause task switching, long navigation, fragmented information, and workarounds.

An enterprise master patient index (EMPI) is a system that maintains consistent, accurate information about each registered patient and can link smaller patient indexes or aggregate data across systems. This post explains deterministic, probabilistic, and referential matching, what an evaluation against a 30,000-record gold standard from a health information exchange with over 47 million registrations found, and what a linkage study of 2,247 patients shows about method choice.

A contingency plan is an alternative plan that takes effect when normal operations are interrupted by an emergency, failover, or disaster. This post explains the five elements in the HIPAA Security Rule’s contingency plan standard, what a scoping review found about 701 days of hospital downtime in the US, what an analysis of 204 EHR downtime events in a hospital showed, and how nurses carry out the plan at the bedside.

In drug safety, an adverse event (AE) is any untoward medical occurrence associated with the use of a drug or medical product, whether or not the product is thought to have caused it. This post explains the FDA definitions in 21 CFR 312.32, the 15-day and 7-day reporting rules, and how a text-mining study of 2.75 million Dutch health records and a Canadian NLP study found adverse drug events that spontaneous reporting misses.

Voice recognition is the computer analysis of human speech to interpret words and phrases or to identify a particular voice. This post explains how traditional dictation differs from ambient AI scribes, what a controlled evaluation of eight systems found about clinically significant transcription errors, what two emergency department studies found about documentation time, and why interpreter-mediated visits are a risk.

Social media fatigue is the tendency of users to withdraw from social media when they feel overwhelmed by too many platforms, connections, and hours online, with boredom and privacy concerns also contributing. This post explains how the construct is measured, what a survey of 1,108 Chinese university students linked it to, what 158 European nurses said about information overload on social media, and what it means for health communication.

A registry is a directory-like system that manages data about one kind of entity so that records can be found by predefined search parameters. This post explains how registries inside an EHR differ from disease and clinical registries, what a study of robotic process automation in two cancer registries found, what a 1,076-record COPD reporting analysis showed about documentation gaps, and how automated multi-source registries are being built.

Long-term services and supports (LTSS) are the medical and nonmedical services provided over a prolonged period to people with limited mobility, cognitive impairment, disabilities, complex medical needs, or chronic disease. This post explains who delivers them, why information often fails to reach LTSS providers, and what a sepsis transitions study, a scoping review of nursing and technology in home rehabilitation, and a Scottish integration case study found.

Integration is the process of joining separately developed parts so they function as one connected system. This post explains the common approaches in health IT, from point-to-point interfaces and interface engines to APIs and single-platform strategies, and what a focus group study, a sepsis transitions study with 91 participants, and a 13-year Scottish case study found about missing data and long-term integration efforts.

Digital health literacy, also called eHealth literacy, is the ability to seek, find, understand, and appraise health information from electronic sources and apply it to a health problem. This post explains what a meta-analysis of 23 studies of older adults found about interventions, what a review of 13 studies in chronic kidney disease says about facilitators and barriers, and why measurement tools struggle with AI.

A consent directive is the record of a person’s privacy choices, stating who may perform which operations on their health data, for which purposes, under what conditions, and for how long. This post explains how it differs from a paper consent form, what 42 CFR 2.31 requires of written consent for substance use disorder records, and what interviews with 16 stakeholders and a multi-system prototype show about building granular consent.

Appropriate use criteria (AUC) are evidence-based criteria that help clinicians choose the most suitable test or treatment for a clinical condition. This post explains how the Medicare AUC program for advanced imaging was designed under the Protecting Access to Medicare Act, the current status of its regulation, and what a federal demonstration and a health system study found about decision support and free-text order indications.

A vulnerability assessment is a systematic examination of a system to find, rank, and understand its security weaknesses and to judge whether safeguards are adequate. This post explains how it differs from a HIPAA risk analysis and a penetration test, what NIST guidance covers, and what a study that scanned 144 pieces of networked equipment in a radiology department found.

A security incident is an event that actually or potentially threatens the confidentiality, integrity, or availability of an information system or its data, or that violates security policy. This post explains the HIPAA definition in 45 CFR 164.304, the response requirement in 164.308, how an incident becomes a breach with a 60-day notice deadline, and what interviews and a literature review found about ransomware and emergency care.

The Quality Payment Program (QPP) is the CMS program created under MACRA that adjusts Medicare payments to clinicians through two tracks, the Merit-based Incentive Payment System (MIPS) and Advanced Alternative Payment Models. This post explains the four MIPS performance categories, the performance threshold and 9 percent adjustment in 42 CFR 414.1405, and what two studies found about how payment adjustments differ by reporting pathway.

A medical error is a planned action that fails to be completed as intended or the use of a wrong plan, and it is also used for mistakes that harm patients. This post explains what the WHO and a 5,000-chart Korean review found about harm and preventability, what a review says about barcode medication administration, and how errors affect the nurses involved.

Health information privacy is an individual’s right to control how identifiable health data are acquired, used, and disclosed. This post explains the HIPAA general rule on uses and disclosures, the right of access with its 30-day timeline, and the right to an accounting of disclosures, then looks at what an interview study of health care leaders and a survey on data control found about sharing and patient choice.

Data de-identification is the process of removing or altering information so that health data no longer identify an individual. This post explains the two HIPAA methods in 45 CFR 164.514, expert determination and Safe Harbor with 18 identifiers, and what studies found about re-identification risk in clinical notes, rare disease patients, and organizational data sharing practices.