HRIP cheat sheet

Data governance = decision rights and accountability for data; stewardship = operational execution of those decisions at the domain level.

Core governance artifacts: data policy, data standard, data owner (accountable), data steward (custodial), and escalation path for disputes.

HIPAA minimum necessary is a governance rule: access is scoped to purpose, not to job title or seniority.

Data classification tiers typically run Public → Internal → Confidential (PHI/PII) → Restricted; controls escalate with tier.

A data dictionary entry must specify name, definition, data type, allowable values, source system, owner, and sensitivity class.

Master data management resolves patient/provider/facility identity; enterprise master patient index (EMPI) is the patient-domain instance.

Governance council quorum and decision logging are required for defensible standard changes; undocumented decisions are not governance.

Retention schedules are driven by the longest applicable requirement (e.g., clinical record retention vs. research consent withdrawal).

CDISC SDTM organizes submission data by observation class (Interventions, Events, Findings, Special-Purpose, Trial Design); ADaM holds analysis-ready datasets.

Terminology map: SNOMED CT for clinical findings/procedures, LOINC for lab and observation questions, RxNorm for medications, ICD-10-CM for billing diagnosis, CPT/HCPCS for procedures.

HL7 v2 is pipe-delimited messaging (ADT, ORU, ORM); HL7 FHIR is resource-based REST with JSON/XML payloads.

CRF design rule: one question = one variable; avoid double-barreled items; capture raw values, derive later.

Query management lifecycle: raise → respond → resolve → close; every query carries an audit trail and a reason code.

Edit checks split into single-field (range, format), cross-field (consistency), and cross-form (temporal) categories.

SAE reporting clock: initial notification generally within 24 hours of awareness; follow-up within the protocol-specified window.

Free-text clinical notes require NLP-assisted abstraction with human confirmation; unvalidated extraction is not a source of record.

EHR vs. EMR: EHR is cross-organization and longitudinal; EMR is a single-organization record.

Interface engine patterns: point-to-point, hub-and-spoke, and publish/subscribe; hub-and-spoke reduces connection count from n(n−1)/2 to n.

FHIR interaction verbs: read, search, create, update, patch, delete; bundles use transaction or batch semantics.

Terminology binding strengths in FHIR: required > extensible > preferred > example; required binding rejects non-conformant codes.

ADT event types: A01 admit, A03 discharge, A04 register, A08 update, A31 update person - misrouted A08 is a common reconciliation failure.

IHE profiles (XDS, PIX, PDQ, XCA) define cross-enterprise document sharing and patient identity resolution.

Interoperability maturity ladder: syntactic (structure) → semantic (meaning) → process (workflow) → organizational.

Uptime and downtime: business continuity requires a read-only downtime mode with defined data-capture reconciliation on restore.

Phase I: safety/dose-finding; Phase II: efficacy signal; Phase III: confirmatory comparison vs. control; Phase IV: post-marketing.

Randomization removes confounding by indication; blinding removes measurement and ascertainment bias.

Intention-to-treat preserves randomization but dilutes effect; per-protocol estimates efficacy under adherence but risks bias.

Sample size drivers: effect size, variance, alpha, power, and expected attrition; halving the effect size roughly quadruples n.

Bias taxonomy: selection, information/measurement, confounding, and attrition - each has a distinct mitigation.

Causal inference tools: randomization, restriction, matching, stratification, multivariable adjustment, instrumental variables, propensity scores.

STROBE for observational studies, CONSORT for randomized trials, PRISMA for systematic reviews, SPIRIT for protocols.

Confounding vs. effect modification: confounding is a nuisance to remove; effect modification is a real subgroup difference to report.

p-value = probability of data at least this extreme given H0 true; it is not the probability H0 is true.

Type I error (alpha) = false positive; Type II error (beta) = false negative; power = 1 − beta.

95% CI ≈ estimate ± 1.96 × SE; a CI excluding the null corresponds to p < 0.05 for the same two-sided test.

Relative risk = incidence exposed / incidence unexposed; odds ratio approximates RR only when outcome is rare (<10%).

Absolute risk reduction = control event rate − treatment event rate; NNT = 1 / ARR.

Sensitivity = TP/(TP+FN); specificity = TN/(TN+FP); PPV depends on prevalence, sensitivity, and specificity.

Multiple comparisons inflate family-wise error; control with Bonferroni (alpha/m) or Benjamini-Hochberg FDR.

Parametric tests assume normality and equal variance; use nonparametric alternatives (Mann-Whitney, Kruskal-Wallis) when violated.

Missing data mechanisms: MCAR, MAR (handled by multiple imputation), MNAR (requires sensitivity analysis).

HIPAA Privacy Rule governs use/disclosure of PHI; Security Rule covers ePHI confidentiality, integrity, availability; Breach Notification Rule sets the 60-day notice clock.

Safe Harbor de-identification removes 18 identifier categories; Expert Determination requires a qualified statistician to certify re-identification risk is very small.

HIPAA identifiers include dates more specific than year, ZIP codes (full), device identifiers, biometric identifiers, and full-face photos.

Minimum necessary applies to uses and disclosures but not to treatment, payment-to-provider, or disclosures to the individual.

GDPR roles: controller determines purpose; processor acts on instructions; special-category data includes health data and requires an explicit lawful basis.

Common Rule: IRB review, informed consent, and 45 CFR 46 Subpart D protections for children; Subpart B for pregnant women and prisoners.

21 CFR Part 11 requires audit trails, e-signature attribution, and access controls for electronic records used in regulated trials.

Security triad (CIA) controls map to administrative, physical, and technical safeguards; encryption at rest and in transit is addressable-to-required in practice.

Breach risk assessment considers data type, recipient, and mitigation; low-probability-of-compromise determinations must be documented.

Six quality dimensions: completeness, accuracy, consistency, timeliness, validity, uniqueness.

Completeness = non-null required fields / total required fields; report per field, not per record, to find systematic gaps.

Duplicate detection uses deterministic matching (exact keys) or probabilistic matching (weighted agreement across fields).

Audit trail requirements: who, what, when, and why; original values must be retained and recoverable, never overwritten.

Source data verification compares CRF entries to source documents; a discrepancy rate above threshold triggers retraining or re-monitoring.

Data lineage traces value from source system through transformation to report; missing lineage invalidates downstream metrics.

Range and logic checks catch entry errors; they cannot catch a plausible but wrong value - only source comparison can.

Version control: every dataset release needs a frozen snapshot, a change log, and a reproducible derivation script.

Chart selection rule: comparison → bar; distribution → histogram/box; trend over time → line; relationship → scatter; composition → stacked bar (avoid pie beyond 3 slices).

Truncated y-axes exaggerate differences; bar charts must start at zero, line charts may not.

Colorblind-safe palettes avoid red/green pairs; max ~7 categorical colors before grouping is needed.

Absolute risk must accompany relative risk in reporting; relative-only framing overstates small effects.

Tables for precision, figures for pattern; do not duplicate the same numbers in both.

Reporting guidelines: CONSORT diagram for trial flow, STROBE checklist for observational, PRISMA flow for reviews.

Data visualization accessibility: alt text, sufficient contrast (WCAG AA 4.5:1), and no color-only encoding.

Dissemination tiers: internal dashboard → conference abstract → peer-reviewed manuscript → public dataset; each requires a disclosure review.