A Legal Framework to Enable Sharing of Clinical Decision Support Knowledge and Services across Institutional Boundaries

Abstract

The goal of the CDS Consortium (CDSC) is to assess, define, demonstrate, and evaluate best practices for knowledge management and clinical decision support in healthcare information technology at scale – across multiple ambulatory care settings and Electronic Health Record technology platforms. In the course of the CDSC research effort, it became evident that a sound legal foundation was required for knowledge sharing and clinical decision support services in order to address data sharing, intellectual property, accountability, and liability concerns. This paper outlines the framework utilized for developing agreements in support of sharing, accessing, and publishing content via the CDSC Knowledge Management Portal as well as an agreement in support of deployment and consumption of CDSC developed web services in the context of a research project under IRB oversight.

Introduction

Clinical Decision Support (CDS) has been shown to greatly improve the quality and safety of healthcare when delivered at the point of care.^{1, 2} Despite broad national policy initiatives to increase Electronic Health Record (EHR) adoption in the US, current adoption of advanced clinical decision support remains limited. Among the variety of reasons cited is the absence of readily accessible knowledge resources to implement CDS including human readable and encoded guidelines as well as information about best practice approaches to their implementation.³ In 2008, the CDS Consortium, comprised of researchers, vendors and healthcare delivery institutions http://www.partners.org/cird/cdsc/, was established with the explicit goal of assessing, defining, demonstrating, and evaluating best practices for knowledge management and clinical decision support in healthcare information technology at scale – across multiple ambulatory care settings and EHR technology platforms.⁴ The deliverables of this effort include a CDSC Knowledge Management Portal and Repository (CDSC KM Portal) to support sharing of readable and importable CDS knowledge artifacts among the diverse members of the Consortium, and the creation and implementation of knowledge-based web services for CDS integrated with multiple EHR platforms.

One of the primary goals of the CDS Consortium is to create a single context to promote the sharing of CDS artifacts for as many users as possible. There are prior and ongoing efforts to establish repositories for CDS artifact sharing.^{5, 6, 7, 8} The Institute for Medical Knowledge Implementation (IMKI), a non-profit organization founded by Epic, Eclipsys, Siemens, and GE was dissolved in 2003. Among the issues cited was an unwillingness of participants to share content.^{9, 10} There are many barriers to content sharing, in addition to intellectual property and liability concerns, such as the complexity of defining the scope and structure of knowledge artifacts and the burden of developing and updating published content.¹⁰

In the course of the CDSC project, the Content Governance Committee (CGC), the editorial policy committee of the CDSC, uncovered similar concerns among members regarding intellectual property, data sharing, liability, and accountability with regard to playing the role as a supplier or a consumer of CDS content and/or services. It was determined that the development of a legal framework was necessary to address these concerns and enable the project to move forward. The illustration (Figure 1) below illustrates three legal agreements that have been developed by CDSC to provide a legal foundation for sharing of CDS content as artifacts via a portal and in the form of web services. Signing the first and second agreements is required for institutions that would like to either share or access knowledge and content stored on the CDSC KM portal. Signing the third agreement is required for institutions that would like to implement and utilize CDSC developed CDS services and share patient date via these services. Depending on a role that an institution has chosen to play in the CDSC, it may sign one, two, or all three of the agreements.

Figure 1.

Three legal agreements developed by CDSC.

The CDSC Knowledge Management Portal

The CDSC KM portal, http://cdsportal.partners.org/CDSCSearch.aspx, is a view into a repository of CDS artifacts ranging from human-readable unstructured practice guidelines to highly structured, encoded executable knowledge. The CDSC Knowledge Translation and Specifications (KTS) team has defined best practices for knowledge representation, data representation, and specification of knowledge content formats ranging from human readable expression of content, to expression of content for web services implementation. The KTS team has specified four levels of transformation and specification:

• Level 1 –Any human readable guideline in any document format;

• Level 2 – Unstructured: A guideline that has been deconstructed into rule statements and associated metadata and follows an XML schema;

• Level 3 – Structured and Encoded: A Level 2 guideline that now carries with it the relevant and disambiguated encoding information to enable rendering in XML for import and interpretation by an inference engine;

• Level 4 – Implementation: Either executable code, and a description, illustration, or export from an authoring-environment that details a specific implementation of a clinical decision support system (e.g. rules fully specified and encoded for a rules engine).

The KTS team developed specifications in each of these four levels for disease management content in the clinical domains of Diabetes Mellitus, Coronary Artery Disease, and Hypertension utilizing guidelines from the U.S. Preventive Services Task Force and the American Diabetes Association. It was recognized that many participating CDSC organizations have a rich array of CDS implementation artifacts in the form of descriptions, illustrations, and exports that would be desirable to make available to the portal. This information represents decades of combined experience and lessons learned in the implementation of CDS content integrated into workflow.

The illustration (Figure 2) below describes how as guidelines are transformed across levels, they acquire “derivative-of” relationships to their antecedent levels to portray connections to the primary evidence-base. The CDS content developed by the KTS team follows a knowledge translation process in a straightforward manner. However, for some Level 4 content that represents implementations of CDS content, it may be that a Level 4 document has either no derivative-of relationship or only a derivative-of relationship to a Level 1 raw guideline. In addition, a CDSC member might create a different Level 3 derivative of a previous Level 3 because they might have a different assessment of how that Level 3 should be encoded.

Figure 2.

The four levels of CDSC knowledge translation and specification.

The CDSC Rule Execution Services

The CDSC Services team is responsible for developing and implementing machine executable content. They will demonstrate the creation of publicly available CDS web services in the clinical domain areas of diabetes, coronary artery disease, and hypertension. The CDS Services are being consumed by electronic health records (EHR) at Partners HealthCare, Regenstrief Institute (RI), and in the future as well as by commercial EHR products.

The Enterprise Clinical Rules Service (ECRS) accepts data in the form of a Continuity of Care Document (CCD), reasons over this data utilizing a large rule set, and provides assessments and recommendations back to end-users in the form of an eXtensible Markup Language (XML) message. Therefore, for example, for each RI patient in the research clinic cohort of clinicians and patients, RI will send patient information in the form of a CCD to the ECRS. The ECRS rules engine will process the CCD and send back patient-specific assessments and recommendations in an XML format. These messages are surfaced in the EHR to the clinician at workflow insertion points deemed appropriate by the services consumer.

As integration work progressed with Regenstrief, the first web services consumer outside of Partners HealthCare, it became clear that a legal framework was necessary to define service provider and consumer responsibilities for integration of the Enterprise Clinical Rules Service (ECRS) and related content. In addition to the considerations of intellectual property and liability mentioned above, such a framework must address data and knowledge sharing, encryption, reasoning over data, and auditing of data and decisions.

The primary goal of CDSC: to promote knowledge sharing for use in health IT to improve patient safety and quality, advance the adoption and effective use of health IT, and further the transformation of US healthcare. All members of the CDS Consortium share this goal. However, to overcome a predilection not to share content several issues had to be addressed: intellectual property, attribution of source in derivative works, ownership, and liability. We discuss each of these issues in turn.

Intellectual Property

Evidence-based guidelines that inform accepted standards for clinical care are typically developed by medical societies or government-sponsored task forces and placed into the public domain. Subsequently, when a healthcare delivery institution wishes to transform these into a CDS artifact, significant effort must be made to disambiguate the recommendations, and then determine the most effective approach for logic design and workflow insertion that results in overall support of adherence to the guideline. Content vendors are also engaged in the business of selling evidence-based clinical decision support content to healthcare delivery entities. Typically even vendor-transformed artifacts must undergo further transformation to achieve successful implementation at a healthcare delivery site. These transformations result in assets that may have multiple vendor and non-profit entity sources of contribution. The goal of the CDSC is to advance the sharing of CDS content where there is a will to do so and where there is indisputable non-commercial ownership of the asset, thus a framework was necessary to create a safe approach to sharing CDS content while ensuring that intellectual property rights of contributing parties are respected.

Creative Commons is a nonprofit corporation established in 2001 that is dedicated to making it easier for people to share and build upon the work of others, consistent with copyright laws.¹¹ They offer six free licenses for download that represent permutations of combinations of four different license considerations:¹²

• Attribution – Licensee may copy, distribute, display, and perform copyrighted work — and derivative works based upon it — but only if they give credit as requested.

• Share-alike – Allows others to distribute derivative works only under a license identical to the license that governs original published work.

• Non-Commercial – Allows others to copy, distribute, display and perform published work — and derivative works based upon it — but for non-commercial purposes only.

• No Derivative Works – Allows others to copy, distribute, display, and perform only verbatim copies of your work, not derivative works based upon it.

These legal considerations and the licensing language at Creative Commons served as a reference point for the CGC and our legal team to craft language for the unique context of sharing and implementation of CDS artifacts. The CGC editorial policy identified several principles for promoting content sharing in a context of respect for intellectual property and proper attribution:

• Members sharing CDS artifacts should be accountable for respecting their own intellectual property agreements with third-party content suppliers.

• The CDSC member institution that authors a CDS artifact has sole authorship rights. Yet, by publishing CDS artifacts to the CDSC KM Portal, an institution grants a license to other CDSC members to make derivatives of that content. All derivative works must cite the original source.

• CDS artifacts published to the CDSC KM Portal are shared freely and may not be sold by CDSC members, or, for that matter, by anyone accessing the portal for commercial purposes in native or derivative form.

It was determined that given the principles outlined above, only the first three conditions were applicable to the attribution and intellectual property considerations of the CDSC. Indeed, given the primary goal of the CDS Consortium it is desirable for members to create and share derivative work as CDS artifacts are developed, refined, and implemented. Further, these CDS artifacts are intended for distribution, display and embedding as encoded knowledge in EHR decision support environments rather than “performed”, thus the legal language warranted some critical modifications. Language was drafted for both a Publisher and an End-user agreement to address the considerations outlined above. The Publisher agreement contains language that covers the following considerations:

• Attribution: “[CDSC] agrees to use best efforts to provide acknowledgement and attribution to [Publisher] for any [CDS artifacts] published on the Portal, in a form and format consistent with scientific and academic practices.”

• Publishing for free distribution: “[the Publisher] hereby grants to [CDSC] … the nonexclusive, perpetual, irrevocable, royalty free, fully paid up, worldwide right and license (i) to publish, display, copy, distribute, use, modify and create derivative works of all [CDS artifacts] … for free distribution and not for any sale or resale purpose.”

• Rights granted by the publisher to portal End-users who signs the access agreement: “…right and license to display, copy, distribute, use, modify, and create derivative works of [CDSC artifacts] solely for such End-user’s own internal patient care…”

• Warranties that the Publisher fully owns the CDS artifacts submitted: “[Publisher] represents and warrants that: (i) all [CDS artifacts] submitted … is owned or controlled by [Publisher]; (ii) [Publisher] has all rights and licenses from third parties necessary to grant the rights and licenses granted to [CDSC]; and (iii) [Publisher] has all right and authority to enter into this agreement and to grant the rights granted herein”

To promote understanding of these principles and to ensure compliance, in the CDSC KM Portal an End-user agreement is the first page an end-user sees, and the user must “click-through” with each visit session. It contains language that covers the following considerations:

• Content access and use: “[CDSC] grants End-user the following rights to the CDS Content, subject to the terms and conditions hereof, solely for such End-user’s own internal patient care, medical procedures and medical education purposes, and not for any sale, resale or any commercial benefit.”

• Content ownership: “Nothing in these Terms of Use is intended to transfer any rights of ownership in any copyright in any of the CDS Content; however, End-user shall own all modifications and derivative works authored by such End-user, subject to the pre-existing copyright and license restrictions on the original CDS Content”

• Attribution: “…may modify and make derivative works of the CDS Content, provided that clear attribution to the original copyright holder is included in each copy of the modified or derivative work …”

A Circle of Mutual Indemnification

In addition to the intellectual property issues, the CDS Consortium needed to address the issues surrounding liability with respect to knowledge sharing and clinical decision support. Hurwitz, in his analysis of the potential liability of guideline authors, argues that “there can be no duty of care between the author of a document … and its myriad potential readers, unless the authors could foresee that their written advice would be directly communicated to a reader who would have little choice but to rely on it without independent enquiry”.¹³ In the case of the CDS Consortium KM Portal, guideline content is published in a variety of formats outlined above, and an “end-user” in this case is not necessarily a practicing clinician. The end user may be a part of a an EHR implementation team that must consider carefully how to deploy this content in their local environment. Waitman and Miller estimate that “90% of the effort required for successful guideline implementation is (and must be) local, and the remaining 10% of the effort involves getting the [CDS content] right”¹⁴. They go on to outline the myriad tasks that an implementing site must perform to “localize” a CDS artifact for implementation that ensures effectiveness, validity, usability, end-user adoption, and accountability for maintenance and update in their local EHR knowledge management process. Because the CDSC KM portal is a library of document-based CDS assets, the CGC preferred to adopt an editorial policy that the member “submitting the content to the portal is endorsing that the content has been developed in accordance with the quality measures in place for other production-ready decision support rules at their own institution”. However, as in the case of authors and publishers of medical textbooks and clinical guidelines that are widely in use, the CGC members would make no warranty or guarantee of accuracy of CDS content and take no responsibility for harm resulting from errors – the clinician remains the primary accountable party for all health care decisions.

Language was drafted for both a Publisher and an End-user agreement to address the mutual indemnification considerations outlined above. The Publisher agreement contains language that covers the following considerations:

• No warrantees: “[CDSC does not] warrant that access to the portal will be uninterrupted or error-free, or that defects, if any, will be corrected; nor does [CDSC] make any representations about the accuracy, reliability, currency, quality, completeness, usefulness, performance, security, legality or suitability of the portal or any of the information contained therein.”

• Liability: “[Publisher] agrees to and shall indemnify, defend, and hold harmless [CDSC] against any liability, damage, loss, or expense … of any kind … in connection with any claims, suits, actions, demands, or judgments arising out of any theory of liability (including without limitation actions in the form of tort, warranty, or strict liability and regardless of whether such action has any factual basis) relating to any Submission made by [Publisher]…”

The Click-through End-user agreement contains language that addresses the following considerations:

• No warrantees: “The CDS Content is provided on an “AS IS” basis. In view of the possibility of error of omission or commission by the authors, editors, officers, directors, employees, agents, licensors, suppliers, affiliates, or contributors of the CDS Content, [CDSC does not] warrant that the CDS Content is in every respect accurate or complete, and they are not responsible for any errors of omission or commission or for the results obtained from the use of such CDS Content. End-users are encouraged to confirm the information contained in any CDS Content with other sources.”

• Liability: “In no event will [CDSC] be liable for any damages (including, without limitation, incidental and consequential damages, personal injury/wrongful death, lost profits, or damages resulting from lost data or business interruption) resulting from the use or inability to use the CDS Content whether based on warranty, contract, tort or any other legal theory, and whether or not [CDSC has] been advised of the possibility of such damages.”

• Medical disclaimer: “Access to the portal and the information contained therein is not a substitute for professional judgment of health care professionals in diagnosing and treating patients. [CDSC does not] assume any liability or responsibility for damage or injury (including death) to End-user or any other persons or property arising from any use of or reliance upon any information, idea, or instruction accessed by End-user through the portal.”

CDS software, implemented locally or via an externally supplied web service, can guide a clinician’s assessment, documentation, and therapeutic decision making. However, the quality of such guidance is limited by the CDS content embedded in the software and the patient-data richness that is delivered to the CDS software. Among the myriad ways CDS software may impact liability,¹⁵ three primary points-of-failure were considered in developing a legal agreement:

• CDS manufacturing defect-- such that the software does not perform as designed such as when the alerts fail to notify due to bug in software or service

• CDS implementation defect-- such as when alerts fail to fire because the customer has failed to update or accurately represent knowledge in the system

• CDS user error-- such as when a user ignores or turns off a notification

Even if manufactured, implemented and used correctly, given gaps in patient data availability, CDS software cannot be expected to generate accurate patient assessments and care recommendations every time. It is expected that users will interpret CDS software advice for what it is -- advice -- and then exercise their own independent, professional medical judgment and make the decision. Miller and Miller asserted that CDS software “does not replace the judgment or the functions of a physician; instead, it augments the physician’s existing knowledge by providing further information”.¹⁶ They further point out that “even if the software provides an erroneous diagnosis, the doctor subsequently acting on the information possesses specialized knowledge of the patient… and is therefore in the best position to evaluate and reject faulty or inapposite advice”. Indeed, well designed CDS software allows the clinician to override CDS advice, and in best cases, captures and tracks override rationales so that these data can be utilized to improve the effectiveness of the CDS interventions. Currently, CDS software does not fall under the purview of medical device regulations; however, it has been argued that design, development and deployment of such software may eventually be legally required to acknowledge a “duty of care”.^{17, 18, 19}

In the context of the CDSC Rules Service component of the project, Partners Healthcare System will host CDS services and provide clinical recommendations to an external entity, the first being Regenstrief Institute (RI). From the perspective of Regenstrief, Partners could be considered a vendor. It became necessary to frame the liability concerns for this inter-entity relationship as a research study and state this clearly in the text of the agreement.

With the above in mind, language was drafted for the “Services Sharing Agreement” that includes the following considerations:

• Licensee acknowledges and agrees that the [CDSC Rules Service] (i) is a beta test version for research purposes only and not available for commercial distribution, (ii) may contain bugs, defects and errors, and (iii) may not function with consistency during the Term of this Agreement.

• Licensee will ensure through the use of written notifications, application generated on-screen acknowledgements and training that all Users understand that the [CDSC Rules Service] is to be used as a supplement to other clinical decision support methods, including without limitation, the medical judgment of the clinician, and that the [CDSC Rules Service] does not serve as a replacement for a clinician’s judgment or clinical diagnosis.

• In the event of any problem with the [CDSC Rules Service] or any of its content, licensee agrees that licensee’s sole remedy is to cease using the [CDSC Rules Service].

• Except to the extent that Licensee has entered into an IRB-governed clinical trial agreement … the [CDSC Rules Service] will be used solely as a supplement to Licensee’s existing or additional clinical decision support systems.

• The [CDSC Rules Service is in beta form for a system intended to provide clinical decision support through the analysis of certain data. The [CDSC Rules Service] has not been reviewed or approved by the US Food and Drug Administration or by any other agency

Accountability of CDS Services Providers and Consumers

The service provider, or CDS Consortium Services team, has many responsibilities, which include assuring the most recent clinical guidelines and the best practice logic is utilized by the services, assuring that the CDSC Rules Service produces a correct recommendation for any given set of data, and that it provides timely notice to all consumers if any changes that occur as a byproduct of content maintenance such as changes in the definitions, classifications, or practice logic used by the service. The service consumer has his unique set of responsibilities as well. The consuming side is responsible for ensuring that 1) local institutional definitions are aligned with the classifications used by the ECRS, and remain aligned if local terminologies change, 2) creating Continuity of Care Documents (CCDs) in a manner that accurately represents patient data using the format and terminologies prescribed by the ECRS, and 3) conducting thorough end-to-end testing to ensure that the desired outputs are produced by a given set of inputs. The following language has been drafted to assure mutual accountability:

• Licensee will cooperate fully in providing all necessary information to ensure that data flows between the parties in a format and using terminologies that are recognizable and consistently interpreted by both parties’ relevant computer systems.

• Licensee will be solely and fully responsible for ensuring that the codes sent as input to the [CDSC Rules Service] are consistent with the codes required by the [CDSC Rules Service]

• Licensee shall be responsible for completing any acceptance testing reasonably necessary to demonstrate that the data from the Calling Application generates appropriate [CDSC Rules Service]outputs without material error or deficiency

Data Management, Security, and Confidentiality

As described above, the CDSC rules service reasons over de-identified patient data in the form of a CCD. In addition, for research and troubleshooting purposes, it is necessary for the rules service to retain an audit trail of how the data was interpreted and what recommendations and messages were sent to the services consumer. Thus, legal language must specify the duration and tactics the CDSC will maintain security and confidentiality of the data:

• Licensee is fully and solely responsible for ensuring that it complies with all applicable data protection laws, including but not limited to the Health Insurance Portability and Accountability Act (HIPAA)

• [CDSC Services Team] will only use the personal health information provided hereunder as necessary to operate, evaluate, troubleshoot, or improves the [CDSC Rules Service], pursuant to the IRB for that project [CDSC Research Host] will maintain appropriate administrative, physical, technical and procedural safeguards to protect the confidentiality of electronic information… [including in compliance with] …HIPAA.

• In compliance with applicable legal, IRB and institutional recordkeeping requirements, [CDSC Research Host] will encrypt and retain Licensee Confidential Information for a period of seven (7) years after completion of the research under the AHRQ Contract with security at least equal to the security measures used to protect its own electronic Protected Health Information. Thereafter, such Licensee Confidential Information will be deleted and will not be maintained in any form whatsoever

Disclaimer in the consumer EHR

The service consumer has not only his unique set of responsibilities described above. A clinician is ultimately responsible for making the final decision on utilizing or not the provided decision support. Below is a sample of the disclaimer language that is designed to be displayed with each occurrence of the CDSC generated recommendations:

• This decision support reminder may be inaccurate or based on incomplete data. The clinician should always use proper judgment while taking care of the patient, and should disregard this reminder if it seems clinically inappropriate. This decision support reminder is provided by the Clinical Decision Support Consortium as a component of a research study. It is based on the recommendations of the United States Preventive Services Task Force. For any questions please contact [RI members of CDSC team].

Other Barriers

As the CDS Services provided by the CDS Consortium were developed for production use, other barriers were encountered, in addition to those described above, in establishing related inter-institutional agreements. One critical challenge is the difficulty of determining who at each institution has the authority to sign these agreements on behalf of the institutions, particularly in the realm of content sharing. Another challenge requiring ongoing education and clarification has been confusion regarding the duplication of liability and intellectual property language among the knowledge sharing and services sharing agreements. It is important to decouple these legal agreements as only a few institutions are participating in both kinds of CDS sharing.

Conclusion

Creating a safe legal foundation for sharing CDS content and services represents a critical issue in leveraging best practices for wide-scale adoption from leading institutions in the successful implementation of health IT at scale, and its effective use, particularly clinical decision support functionality. The CDS Consortium represents a unique research environment to introduce and test the full spectrum of knowledge management – from knowledge creation and curation, to encoding and specification, aggregation in a knowledge repository, sharing, and enabling knowledge-based web services. The CDS Consortium has developed a set of clinical content editorial and governance procedures, and a legal framework with component legal agreements to make this resource useful in pursuing the primary goal of CDSC: to promote knowledge sharing for use in health IT to improve patient safety and quality, advance the adoption and effective use of health IT, and further the transformation of US healthcare. To date, we have observed promising collaboration and sharing among CDS Consortium stakeholders and we expect to publish further on lessons learned as we continue this important work.