The current Healthcare Informatics online poll asks whether you would contract with an electronic medical record vendor that had an arrangement with a third party to mine EMR data for research or other purposes. It's important to remember in these situations that an EMR vendor will typically be a business associate of a healthcare provider within the meaning of HIPAA. A compliant business associate agreement must "establish the permitted and required uses and disclosures" of protected health information (PHI) by the business associate. In short, an EMR vendor can share information only to the extent that it has been permitted to do so under the terms of its business associate (BA) agreement.
BA agreements may contain optional provisions permitting "data aggregation" services, "de-identification" of PHI and use for the "proper management and administration" of the business associate. "Data aggregation" and "de-identification" have defined meanings under the HIPAA Privacy Rule. It's a little more unclear how far a vendor may go in using PHI for its own "proper management and administration" purposes. HIPAA covered entities should never sign a BA agreement with an EMR vendor (or any other vendor, for that matter) without watching for these key phrases and understanding fully how the vendor intends to use and disclose their PHI.
