Information Technology and Data Analytics
Domain 5 - Information Technology and Data Analytics. This domain tests how health systems capture, protect, exchange, and use data. Expect questions on privacy and security duties, interoperability standards, and how to judge an analytic model.
Systems and standards
- EHRs, HIEs, and registries depend on standards: HL7 v2 for messaging, FHIR for modern APIs, C-CDA for documents. ONC certification and the HITECH/Promoting Interoperability programs drove adoption and now reward exchange.
- HIPAA Security Rule safeguards are administrative, physical, and technical. The Privacy Rule limits use and disclosure to the minimum necessary, with exceptions for treatment, payment, operations, public health, and required-by-law reporting. Breach notification timelines apply.
Analytics
- Data governance covers ownership, definitions, quality, and access. Data quality dimensions include completeness, accuracy, timeliness, and consistency.
- Analytics maturity: descriptive, diagnostic, predictive, prescriptive. Predictive models need validation: discrimination (AUC, sensitivity, specificity) and calibration, plus workflow fit.
Worked example
A readmission model has AUC 0.68; a vendor claims 0.85. Reasoning: ask about the validation population and outcome definition; check calibration, not just AUC; test on your own data; assess whether an intervention for high-risk patients actually exists; and monitor alert fatigue. A model that ranks risk but cannot change care adds little.
Traps
- Confusing privacy (who may see data) with security (how it is protected).
- Inferring causation from correlation.
- Deploying an unvalidated model or one trained on a different population.
- Neglecting data quality and definitions before building dashboards.