The Analytics Request That Crossed a Line
A hospital's marketing department requests a dataset from the clinical data warehouse to 'identify high-risk patients for a care-management outreach campaign.' The request includes patient name, contact information, diagnosis codes, and recent ED utilization. The informatics analyst notices the request form lacks an IRB determination and that the stated purpose mixes marketing outreach with clinical care. The hospital's privacy officer is on vacation. The marketing director says the CMIO 'already approved it verbally.' The analyst is asked to deliver the extract by end of week. The dataset would include patients with behavioral health diagnoses, which carry heightened sensitivity under state law.
1. What should the analyst do before delivering the extract? Walk through the decision points.
Read the worked answer
The analyst should not deliver the extract on a verbal approval and an incomplete request. Work through the decision points:
- Purpose and lawful basis. 'Marketing outreach' and 'clinical care management' are different uses with different legal bases. Determine which it is. If it is marketing, HIPAA requires authorization or an applicable exception; if it is treatment/payment/operations, document that basis. Mixing the two in one request is a red flag.
- Minimum necessary. Even if a basis exists, deliver only the minimum data needed. Name and contact may be justified for outreach; full diagnosis codes and ED history may not be. Challenge the data elements requested.
- Heightened sensitivity. Behavioral health data may have extra protections under state law and 42 CFR Part 2 (if substance use disorder). Confirm applicability before including those patients.
- Approval authority. A verbal CMIO statement is not a documented approval. Obtain written approval and route through the privacy officer (or their delegate/backup) and, if research, the IRB.
- Escalation. The privacy officer's vacation does not suspend the policy; identify the designated backup.
Document each step. The safe, defensible action is to pause delivery, request written clarification of purpose and data elements, and route for documented approval.
2. Draft the key elements of a response to the marketing director and describe the governance fix to prevent recurrence.
Read the worked answer
Response to marketing director (key elements):
- Acknowledge the request and the CMIO's verbal support, but explain that data releases require documented approval and a defined lawful basis.
- Ask for written clarification: Is the purpose marketing or clinical care management? Who are the intended recipients? What is the outreach mechanism?
- Propose a minimum-necessary dataset that meets the stated goal (e.g., contact information and a risk flag rather than full diagnosis detail), subject to privacy review.
- State the timeline: delivery follows documented approval from the privacy officer (or backup), not a verbal OK.
- Offer to help scope the request so it can move quickly once approved.
Governance fixes:
- A standard data request form that captures purpose, lawful basis, data elements, recipients, retention, and required approvals, with an automated routing rule.
- Tiered review: routine operational requests vs sensitive-data requests (behavioral health, Part 2) requiring additional review.
- Named backup for the privacy officer so approvals do not stall or get bypassed.
- Minimum-necessary checklist built into the request workflow.
- Audit log of all extracts: who requested, who approved, what was delivered.
- Training for marketing and analysts on permissible uses.
These controls convert an ad hoc judgment call into a repeatable, auditable process.