The Joint Commission is launching a voluntary certification program for hospitals and critical access hospitals to demonstrate their responsible use of a patient’s health data for non-clinical purposes, such as quality improvement or artificial intelligence development.
The Responsible Use of Health Data (RUHD) Certification program will open for applications starting Jan. 1 and should be completed within 90 days, the organization told Fierce Healthcare in an exclusive interview.
The new certification is based upon the principles of an existing health data use framework from the Health Evolution Forum, per The Joint Commission, and includes requirements that cover: de-identification, data controls, limitations on use, algorithm validation, patient transparency and oversight structure.
The Joint Commission President and CEO Jonathan Perlin, M.D., told Fierce Healthcare that his group’s new offering will serve as a standardized, objective tool for hospitals to show their commitment to secure handling of patients’ sensitive information.
Perlin said it’s “a direct response” to calls he and The Joint Commission have heard from healthcare industry stakeholders for a third party to develop a “gold standard” resource against which hospitals may test their processes for handling health data.
Healthcare organizations are increasingly transferring patient data to partners and exploring the development and use of novel, data-driven algorithms, Perlin noted. Such uses—along with hospitals’ other ongoing efforts around operations improvement, quality improvement and discovery—fall under the umbrella of “secondary use of data,” which The Joint Commission is targeting with its RUHD Certification program.
Concurrently, patients are more often looking for reassurances that their confidential information isn’t being used inappropriately by hospitals and their partners, he said.
“As someone who’s been involved in health IT and AI for a long time," Perlin said, "I live between two fears—fear on the one hand that we won’t have guardrails to protect appropriate use, and fear on the other hand that we’ll overzealously build limits [so] that we don’t improve care in ways that these tools can increasingly advance care to an unprecedented degree.
“A vehicle such as the RUHD Certification allows organizations to test their controls on the secondary use of data to be sure that they maintain the integrity necessary for the appropriate use within guardrails—but also do what needs to be done to improve care, which is desperately necessary,” he said.
Industry participation in The Joint Commission’s voluntary certifications “is really a spectrum,” but Perlin said he anticipates that hospitals’ demand for a responsible secondary data use standard will lead to greater uptake compared to some of the other voluntary offerings.
The burden of achieving the RUHD certification will likely vary based on specific organizations’ prior work in creating patient data use protections, he said.
Some areas like de-identification are “table stakes for sharing of health information” and should be more commonplace among interested hospitals. Others like data controls he said are “a little bit different—has the organization considered that if they share the data with a second party, for example, that the second party will use [them] only for explicitly stated purpose, and not use that data or retransmit that data for other purposes?
“These things are not inherently burdensome, but they are inherently necessary,” he continued. “It’s likely that most organizations will have contemplated most of the parameters but being able to validate that they’ve tested their approach across all the parameters, I think, gives them credibility in terms of being able to communicate to different stakeholders that they are working responsibly with the data created as a byproduct of care.”
The Joint Commission will be able to better quantify the voluntary certification’s burden for interested hospitals after the survey goes live on Jan. 1, Perlin said.
Richard Schwartz, CEO of Health Evolution, said in a statement that his organization is “honored” that principles highlighted in the Health Evolution Forum’s framework could “serve as a catalyst for this important work.” Those principles “are more pertinent than ever for organizations engaging in cross-sector collaboration to propel a new generation of data-powered solutions as AI forges a new frontier of innovation and discovery in healthcare,” he said.
The Joint Commission’s new offering lands alongside other industry-led efforts to establish best practices as patient data-driven AI becomes more prominent in healthcare. Among these are the Artificial Intelligence Industry Innovation Coalition, the Coalition for Health AI and a more recent initiative called VALID AI, all of which focus on data safeguards and other best practices when developing and deploying these tools.
Additionally, the RUHD Certification’s focus on data transfer to outside parties comes as data privacy and cybersecurity experts highlight the risk third-party partners bring to sensitive healthcare data.