---

📚 Health Informatics - Exam-Ready Master Notes

---

TOPIC 1: Security, Ethics, & GDPR

1.1 Core Regulatory Frameworks

HIPAA (Health Insurance Portability and Accountability Act, USA - 1996)

• Scope: Covers Protected Health Information (PHI) held by Covered Entities (CEs) and Business Associates (BAs)
• PHI = 18 identifiers: Name, address, DOB, phone, fax, email, SSN, MRN, health plan #, account #, certificate #, VIN, device IDs, URLs, IP addresses, biometrics, full-face photographs, any unique identifying number
• Three rules:
  • Privacy Rule: Limits uses/disclosures of PHI; grants patients rights (access, amendment, accounting of disclosures)
  • Security Rule: Applies only to ePHI (electronic PHI); requires Administrative, Physical, Technical safeguards
  • Breach Notification Rule: Notify affected individuals within 60 days; HHS within 60 days; media if >500 in a state
• HITECH Act (2009): Extended HIPAA to BAs directly; increased penalties ($100 - $1.9M per violation category per year); mandated Meaningful Use of EHRs

GDPR (General Data Protection Regulation, EU - 2018)

• Scope: Any organization processing data of EU residents, regardless of location
• Key principles (Article 5): Lawfulness/fairness/transparency; Purpose limitation; Data minimization; Accuracy; Storage limitation; Integrity/confidentiality; Accountability
• Legal bases for processing (Article 6): Consent, Contract, Legal obligation, Vital interests, Public task, Legitimate interests
• Special category data (Article 9): Health data = special category; requires explicit consent OR substantial public interest
• Individual rights:
  • Right to Access (Art. 15)
  • Right to Rectification (Art. 16)
  • Right to Erasure / "Right to be Forgotten" (Art. 17)
  • Right to Restriction of Processing (Art. 18)
  • Right to Data Portability (Art. 20)
  • Right to Object (Art. 21)
  • Rights re: Automated Decision-Making (Art. 22) - critical for AI/ML in medicine
• Data Protection Officer (DPO): Mandatory for health data processors
• Data Protection Impact Assessment (DPIA): Required before high-risk processing (e.g., large-scale health data profiling)
• Penalties: Up to €20M or 4% of global annual turnover (whichever higher) for severe breaches; up to €10M or 2% for less severe
• Breach notification: 72 hours to supervisory authority; "without undue delay" to individuals if high risk

GDPR vs. HIPAA Quick Comparison

---

1.2 Data Privacy Safeguards

De-identification Methods (HIPAA)

1. Safe Harbor Method: Remove all 18 identifiers + no actual knowledge that remaining info could re-identify
2. Expert Determination Method: Statistical/scientific methods confirm very small re-identification risk

Anonymization vs. Pseudonymization

• Anonymization: Irreversible removal of identifying information; GDPR no longer applies
• Pseudonymization: Replace identifiers with codes; re-identification possible with key; GDPR still applies but reduced obligations

Technical Safeguards (ePHI)

• Encryption: At rest (AES-256) and in transit (TLS 1.2+)
• Access Control: Role-Based Access Control (RBAC); Minimum necessary standard; Unique user IDs
• Audit Controls: Logs of ePHI access/modifications; tamper-evident
• Integrity Controls: Hash functions to detect unauthorized alteration
• Transmission Security: End-to-end encryption; VPN for remote access
• Multi-Factor Authentication (MFA): Required best practice
• Data Loss Prevention (DLP): Monitors and blocks unauthorized ePHI exfiltration

Administrative Safeguards

• Security Management Process (Risk Analysis + Risk Management)
• Assigned Security Responsibility
• Workforce Training
• Contingency Plan (Backup, Disaster Recovery, Emergency Mode)
• Business Associate Agreements (BAAs)

Physical Safeguards

• Facility Access Controls
• Workstation Use and Security policies
• Device and Media Controls (disposal = degaussing, wiping, physical destruction)

---

1.3 Patient Consent Models

Types of Consent in Health Information

1. Opt-In (Express Consent): Patient must actively agree before data is used. Default = data NOT shared.
   • Used in: GDPR (general default); research; sensitive data (mental health, HIV, substance abuse)
   • More protective; lower participation rates
2. Opt-Out (Presumed Consent): Data shared unless patient actively refuses. Default = data IS shared.
   • Used in: Many HIEs for treatment purposes; UK NHS national programs
   • Higher data availability; critics cite inadequate autonomy
3. No-Choice / Mandatory: Data shared without option - usually for public health reporting (communicable diseases, cancer registries)
4. Tiered/Granular Consent: Patient selects specific uses (research, clinical care, education separately)
   • Gold standard for precision medicine biobanks
   • Example: All of Us Research Program, UK Biobank
5. Dynamic Consent: Digital platforms allow real-time modification of consent preferences as research evolves

Special Consent Categories

• 42 CFR Part 2: Stricter than HIPAA for substance use disorder records; requires patient-specific written consent for each disclosure
• Mental Health records: Many states require extra consent layer beyond HIPAA
• Genetic Information: GINA (Genetic Information Nondiscrimination Act, 2008) prohibits use in health insurance/employment

Informed Consent Components (Belmont Principles)

• Respect for Persons (Autonomy): Voluntary, informed, capacity to consent
• Beneficence: Maximize benefits, minimize harms
• Justice: Equitable distribution of research burdens and benefits

---

1.4 Regulatory Compliance Standards

ONC (Office of the National Coordinator for Health IT)

• 21st Century Cures Act (2016): Mandates interoperability; prohibits information blocking
• Information Blocking Rule (2020): Providers/health IT developers must not block access to ePHI
  • 8 exceptions (security, privacy, preventing harm, etc.)
• USCDI (United States Core Data for Interoperability): Minimum dataset for exchange

FDA Oversight of Health IT

• SaMD (Software as a Medical Device): Clinical decision support with high risk = FDA regulated
• GMLP (Good Machine Learning Practice): Principles for AI/ML-based SaMD lifecycle management
• Predetermined Change Control Plan: Allows AI model updates without full FDA re-review

ISO/IEC Standards

• ISO 27001: Information Security Management Systems
• ISO 27799: Health informatics - information security management in health
• IEC 62304: Medical device software lifecycle
• HL7 FHIR R4: Data exchange standard (not a law, but compliance often regulatory requirement)

Ethical Frameworks

• Principles of Biomedical Ethics (Beauchamp & Childress): Autonomy, Beneficence, Non-maleficence, Justice
• AMA Code of Medical Ethics: Professional obligation to protect patient privacy
• IEEE Ethically Aligned Design: Transparency, accountability, non-maleficence for AI systems

---

TOPIC 2: Health Information Exchange (HIE)

2.1 Definition and Purpose

• Reduce duplicate testing
• Prevent medication errors (complete medication history)
• Improve care coordination (especially transitions of care)
• Enable population health management
• Reduce costs

---

2.2 Exchange Modalities

1. Directed Exchange

• Definition: Sending health information directly to a known, trusted recipient (provider-to-provider)
• Mechanism: Analogous to encrypted email; uses Direct Protocol (DirectTrust standard)
• Protocol: SMTP + S/MIME encryption; requires DirectTrust-issued digital certificates
• Use cases: Referral letters, discharge summaries, lab results to ordering provider, care transitions
• Key features:
  • Push-based (sender initiates)
  • Point-to-point
  • Does NOT require central data repository
  • Simpler to implement than query-based

2. Query-Based Exchange

• Definition: Provider queries a network to find and retrieve patient information from unknown sources
• Mechanism: Pull-based; provider requests records when patient presents, even without prior relationship
• Standards: HL7 FHIR, IHE profiles (XDS - Cross-Enterprise Document Sharing), CommonWell, Carequality
• Use cases: Emergency department (patient unconscious), specialist unable to reach PCP, medication reconciliation
• Key features:
  • Pull-based (requester initiates)
  • Requires patient matching infrastructure (MPI - Master Patient Index)
  • Often requires consent or "treatment relationship" justification
  • More complex; requires trust framework

3. Consumer-Mediated Exchange

• Definition: Patients collect, maintain, and direct their own health information
• Mechanism: Patient accesses, aggregates, and shares their own records
• Examples:
  • Patient portals (MyChart, MyHealtheVet)
  • Personal Health Records (PHR): Apple Health, Google Health
  • Blue Button (CMS initiative - Medicare beneficiaries download own claims data)
  • SMART on FHIR apps (patient-authorized third-party apps)
• Use cases: Patient manages chronic disease, second opinions, aggregating records from multiple providers
• Key features:
  • Patient-controlled
  • Empowers patient autonomy
  • Requires health literacy and digital access

Exchange Modalities Comparison Table

---

2.3 Interoperability Levels

HIMSS Definition (Four Levels)

1. Foundational: Basic connectivity - data can be sent/received (e.g., HL7 2.x messaging)
2. Structural: Data format and syntax standardized so receiving system can parse it (e.g., CDA documents, FHIR resources)
3. Semantic: Shared meaning through common terminologies; systems understand content (e.g., SNOMED CT, LOINC, RxNorm, ICD-10)
4. Organizational: Policy, governance, legal, and social frameworks enabling exchange (e.g., trust frameworks, BAAs, state laws)

Key Terminology Standards for Semantic Interoperability

Key Exchange Standards

• HL7 v2.x: Legacy messaging standard; most widely deployed in hospitals; segments (MSH, PID, OBX)
• HL7 v3 / CDA (Clinical Document Architecture): XML-based structured clinical documents; CCD (Continuity of Care Document)
• HL7 FHIR (Fast Healthcare Interoperability Resources): RESTful API-based; JSON/XML resources; current gold standard
  • Resources: Patient, Observation, Condition, Medication, Encounter, AllergyIntolerance
  • Uses OAuth 2.0 for authorization; OpenID Connect for identity
• DICOM: Medical imaging standard (radiology, pathology)
• IHE Profiles: Integration profiles that specify how standards are combined (e.g., PIX, PDQ, XDS, XCA)

---

2.4 Network Topologies

Centralized Architecture

• Structure: Single central repository stores all patient data
• Pros: Easy to query; comprehensive data in one place; simpler to maintain
• Cons: Single point of failure; privacy concerns; expensive; governance challenges
• Example: Some regional HIEs, VA VistA

Federated (Decentralized) Architecture

• Structure: Data stays at originating sites; queries go out to all nodes; results aggregated
• Pros: Data sovereignty maintained; no single breach risk; easier political buy-in
• Cons: Slower queries; data quality inconsistency; complex matching
• Example: CommonWell Health Alliance, most state HIEs (record locator service approach)

Hybrid Architecture

• Structure: Metadata/pointers centralized; actual records stay federated
• Master Patient Index (MPI): Central index matches patients across systems
• Record Locator Service (RLS): Points to where records exist without storing them
• Pros: Balance of queryability and data sovereignty
• Example: Carequality framework, eHealth Exchange

Peer-to-Peer (P2P)

• Structure: Direct connections between nodes without central coordinator
• Pros: Maximum decentralization; resilient
• Cons: Very hard to scale; trust establishment per-pair
• Example: Direct Protocol connections (conceptually P2P)

Topology Comparison

---

2.5 Trust Frameworks and Governance

• DirectTrust: Nonprofit governing Direct Protocol; issues digital certificates to healthcare entities
• CommonWell Health Alliance: Vendor-led network; patient identity matching; consent services
• Carequality: FHIR-based national interoperability framework; governance for query-based exchange
• eHealth Exchange (formerly NwHIN): Federal/private sector trusted exchange network
• ONC Trusted Exchange Framework and Common Agreement (TEFCA): National framework for nationwide HIE; designates Qualified Health Information Networks (QHINs)

---

TOPIC 3: AI & Machine Learning Bias in Medicine

3.1 Foundations of Algorithmic Bias

Definition

Why Healthcare AI is Especially Vulnerable

• Training data historically overrepresents white, male, insured, urban, English-speaking patients
• Outcome labels often reflect existing disparate care rather than true disease burden
• Many health metrics (e.g., eGFR, spirometry) have race-based adjustments embedded (themselves controversial)
• Feedback loops: biased algorithms → biased care → biased future training data

---

3.2 Types of Bias

Data Biases

Proxy Variables

• Definition: A variable used as a substitute for a protected attribute (race, gender, socioeconomic status) that is not directly in the model
• Classic example: Obermeyer et al. (2019, Science): Optum's care management algorithm used healthcare cost as proxy for health needs; since Black patients had less spent on them historically (access barriers), algorithm systematically underestimated their health needs
  • Effect: Black patients assigned same risk score as White patients who were much healthier
  • At the same risk score, Black patients had ~26% more chronic conditions than White patients
• Other proxy examples:
  • ZIP code as proxy for race/socioeconomic status
  • Prior utilization as proxy for health need (confounded by access)
  • Insurance type as proxy for income

---

3.3 Historical Systemic Disparities in Medicine

Key Examples Relevant to AI Bias

• Dermatology: FDA-approved AI tools trained on datasets up to 80% light-skinned patients; performance drops significantly for Fitzpatrick scale V-VI
• Cardiology: Framingham Risk Score developed mostly in white adults; underestimates risk in South Asian, Black populations
• Nephrology: MDRD/CKD-EPI equations historically included race coefficient (now removed per 2021 NKF/ASN taskforce)
• Pulmonology: Spirometry reference ranges have race-based adjustments; now under debate as perpetuating, not correcting, disparities
• Obstetrics: Algorithm underestimated vaginal birth after cesarean (VBAC) success for Black and Hispanic women; led to more unnecessary C-sections
• Pain management: Studies showing Black patients systematically undertreated for pain (false beliefs about pain tolerance); if algorithms trained on prescription patterns, they encode this bias
• Mental Health: NLP trained on clinical notes encodes clinician biases in language about different groups

---

3.4 Fairness Definitions and Mathematical Concepts

Fairness Metrics (mutually exclusive - cannot all be satisfied simultaneously per the "impossibility theorem")

Bias-Variance in Fairness Context

• Bias reduction for one group may increase bias for another
• "Accuracy-fairness trade-off" is real but often overstated; debiasing often improves overall accuracy too

---

3.5 Model Transparency and Explainability (XAI)

Why Transparency Matters in Medicine

• Clinicians need to understand why a recommendation is made to evaluate it critically
• Regulatory requirements (GDPR Art. 22 - right not to be subject to automated decisions without explanation)
• Identifying and auditing for bias requires model interpretability
• Builds clinician trust; prevents "automation bias" (over-reliance on algorithm output)

Explainability Methods

Black-Box vs. Interpretable Models Trade-off

• Deep neural networks / ensemble methods: highest performance, lowest interpretability
• Logistic regression / decision trees: lower performance on complex tasks, highest interpretability
• Clinical deployments increasingly require post-hoc XAI methods on black-box models

FDA/ONC Transparency Requirements

• ONC HTI-1 rule (2024): Requires transparency in clinical decision support algorithms; disclosure of training data, performance metrics, known limitations
• FDA AI/ML Action Plan: Expects lifecycle management, bias monitoring, performance monitoring post-deployment

---

3.6 Audit Rules and Algorithmic Accountability

Pre-deployment Auditing

• Fairness audit: Disaggregated performance metrics by race, sex, age, insurance type, site
• Subgroup analysis: Ensure sufficient sample size and performance in minority subgroups
• Red-team testing: Adversarial testing for unexpected failure modes
• Model cards (Google): Standardized documentation of model purpose, performance, limitations, intended use
• Datasheets for Datasets: Documentation of training data provenance, collection methods, known biases

Post-deployment Monitoring

• Distributional shift monitoring: Alert when input feature distributions change from training distribution
• Performance drift detection: Track AUC, calibration, fairness metrics over time
• Incident reporting: Mechanisms to flag unexpected outputs; integration with healthcare adverse event reporting
• Algorithmic auditing frameworks: Third-party independent audits (analogous to financial audits)

Regulatory and Legal Context

• EU AI Act (2024): High-risk AI systems (including most healthcare AI) require conformity assessment, bias testing, human oversight, transparency
  • High-risk = medical devices, employment, education, law enforcement
  • Unacceptable risk = social scoring, subliminal manipulation (prohibited)
• NYC Local Law 144 (2023): Bias audits required for automated employment decision tools - model for healthcare
• Section 1557 ACA: Prohibits discrimination in federally funded health programs; applies to algorithmic tools
• DHHS Office of Civil Rights: Investigating algorithmic discrimination cases in healthcare

---

TOPIC 4: Natural Language Processing (NLP) - Transformer Architectures

4.1 NLP in Clinical Documentation - Overview

Key NLP Tasks in Healthcare

• Information Extraction: Named Entity Recognition (NER) for medications, diagnoses, procedures
• Clinical Text Classification: ICD coding automation, readmission risk from notes
• Question Answering: Clinical decision support querying
• Summarization: Discharge summary generation, clinical note condensation
• De-identification: Automated removal of PHI from clinical notes (required for research)
• Clinical relation extraction: Drug-drug interactions, symptom-disease associations

Why Clinical NLP is Hard

• Non-standard abbreviations (SOB = shortness of breath vs. "son of a ...")
• Negation and uncertainty ("no chest pain," "rule out MI")
• Temporal expressions ("started 3 days ago," "worsening since last visit")
• Spelling errors, telegraphic style
• Implicit information ("patient is a smoker" implies a risk factor)
• Domain-specific jargon; acronym overload

---

4.2 From RNNs to Transformers - Motivation

Pre-Transformer Architectures

• RNN (Recurrent Neural Network): Processes sequences left-to-right; hidden state carries context
  • Problem: Vanishing/exploding gradients over long sequences
  • Can't capture long-range dependencies well
• LSTM/GRU: Gating mechanisms (cell state, forget/input/output gates) improve long-range memory
  • Still sequential processing - cannot parallelize; slow on long documents
  • Struggled with very long clinical notes (>512 tokens effectively)

The Transformer Breakthrough

• Introduced in "Attention is All You Need" (Vaswani et al., 2017, Google Brain)
• Key innovation: Replace recurrence entirely with Self-Attention
• Fully parallelizable: All positions processed simultaneously - massive speed/scale improvement
• Enables training on massive corpora (GPT, BERT, etc.)

---

4.3 Transformer Architecture - Detailed Breakdown

High-Level Structure

Input Tokens → Embedding + Positional Encoding → 
[N × Encoder Blocks] → [N × Decoder Blocks] → Output

• Encoder-only: BERT, RoBERTa, ClinicalBERT (understanding tasks - classification, NER)
• Decoder-only: GPT series (generative tasks - text generation, summarization)
• Encoder-Decoder: Original Transformer, T5, BART (sequence-to-sequence - translation, summarization)

---

4.4 Input Representation

Tokenization

• WordPiece / BPE (Byte-Pair Encoding): Splits rare words into subword units
  • "antibiotics" → ["anti", "##bio", "##tics"] (WordPiece notation)
  • Handles OOV (out-of-vocabulary) words; critical for medical jargon
• Vocabulary size: Typically 30,000 - 50,000 subword tokens

Token Embeddings

• Each token maps to dense vector (typically 768 or 1024 dimensions)
• Learned during training; semantically similar tokens end up close in embedding space
• E ∈ ℝ^(V × d_model) where V = vocab size, d_model = embedding dimension

Positional Encoding

• Transformers have no inherent sense of order (unlike RNNs)
• Sinusoidal Positional Encoding (original Transformer):
  • PE(pos, 2i) = sin(pos / 10000^(2i/d_model))
  • PE(pos, 2i+1) = cos(pos / 10000^(2i/d_model))
  • Where pos = position, i = dimension index
• Learned Positional Embeddings (BERT): Separate learnable position vectors added to token embeddings
• RoPE (Rotary Position Embedding) (LLaMA, GPT-NeoX): Applies rotational transformation to Q and K in attention
• ALiBi: Adds position-dependent bias to attention scores
• Final input = Token Embedding + Positional Encoding

---

4.5 Self-Attention Mechanism - Core Mathematics

Intuition

Query, Key, Value Matrices

• Q = X · W_Q (Query matrix, W_Q ∈ ℝ^(d_model × d_k))
• K = X · W_K (Key matrix, W_K ∈ ℝ^(d_model × d_k))
• V = X · W_V (Value matrix, W_V ∈ ℝ^(d_model × d_v))

Scaled Dot-Product Attention Formula

Attention(Q, K, V) = softmax(Q · K^T / √d_k) · V

1. Q · K^T: Compute pairwise similarity scores between all token pairs → matrix ∈ ℝ^(n × n)
2. / √d_k: Scale by √d_k to prevent extremely large values that push softmax into saturation regions (near-zero gradients)
3. softmax(...): Normalize scores to sum to 1 → attention weight matrix (each row = probability distribution)
4. · V: Weighted sum of Value vectors → output ∈ ℝ^(n × d_v)

Masked Self-Attention (Decoder)

• In autoregressive generation, token at position i can only attend to positions ≤ i
• Implement by adding -∞ (minus infinity) to future positions before softmax
• After softmax, -∞ becomes 0 → future tokens have zero attention weight

---

4.6 Multi-Head Attention

Formula

MultiHead(Q, K, V) = Concat(head_1, ..., head_h) · W_O

where head_i = Attention(Q·W_Q_i, K·W_K_i, V·W_V_i)

Why Multiple Heads?

• Each head learns to attend to different types of relationships simultaneously
• Head 1: Syntactic dependencies (subject-verb agreement)
• Head 2: Coreference ("patient...he...his")
• Head 3: Medical entity relationships ("metformin" → "glucose")
• Different heads capture different "aspects" of context
• h = 8, 12, 16 heads typical; d_k = d_model / h = 64 (for d_model=512, h=8)

---

4.7 Feed-Forward Network (FFN) Layer

FFN(x) = max(0, x · W_1 + b_1) · W_2 + b_2

• Two linear transformations with ReLU (or GELU in modern models) between them
• Expands to 4× d_model internally (d_ff = 4 × d_model = 3072 for BERT-base)
• Applies same weights to every position independently
• Captures position-level feature transformations after attention aggregates context

---

4.8 Layer Normalization and Residual Connections

Residual (Skip) Connections

x = LayerNorm(x + SubLayer(x))

• Add input to output of each sub-layer (attention, FFN)
• Prevents vanishing gradients; enables training of very deep networks
• Critical for stable training with many layers (12-96+ layers)

Layer Normalization

• Normalizes across feature dimension (not batch dimension)
• LN(x) = γ · (x - μ) / (σ + ε) + β
• More stable than Batch Normalization for sequential/NLP tasks
• Pre-LN (applied before sublayer) vs. Post-LN (original) - Pre-LN more stable in very deep models

---

4.9 Full Encoder Block (Summary)

Input: X ∈ ℝ^(n × d_model)
1. Multi-Head Self-Attention:
   Z = MultiHead(X, X, X)
   X = LayerNorm(X + Z)        ← Residual + LN
2. Feed-Forward Network:
   F = FFN(X)
   X = LayerNorm(X + F)        ← Residual + LN
Output: X ∈ ℝ^(n × d_model)

---

4.10 BERT and Clinical BERT

BERT (Bidirectional Encoder Representations from Transformers, Devlin et al., 2018)

• Architecture: Encoder-only; 12/24 layers; 110M/340M parameters
• Bidirectional: Attends to all tokens in both directions simultaneously (unlike GPT which is left-to-right)
• Pre-training objectives:
  1. Masked Language Modeling (MLM): Randomly mask 15% of tokens; predict masked tokens
  2. Next Sentence Prediction (NSP): Predict if sentence B follows sentence A
• Fine-tuning: Add task-specific layer on top; fine-tune on labeled clinical data

ClinicalBERT (Huang et al., 2019)

• BERT pre-trained on 2M+ clinical notes from MIMIC-III (ICU notes)
• Captures clinical language patterns, medical abbreviations, note structure
• Superior to general BERT on clinical NER, readmission prediction

BioBERT

• BERT pre-trained additionally on PubMed abstracts + PMC full texts
• Superior for biomedical literature tasks (biomedical NER, relation extraction, QA)

GPT in Clinical Settings

• GPT-4 demonstrated near-USMLE-passing performance on medical licensing exams
• Med-PaLM 2 (Google): Expert-level performance on MedQA benchmarks
• Challenges: Hallucination (confident wrong answers); catastrophic for clinical use
• Current consensus: Augmentation tool, not autonomous decision-maker

---

4.11 Attention Complexity and Limitations

Computational Complexity

• Self-attention: O(n²) time and space in sequence length n
• Critical issue: Clinical notes, EHR timelines can be very long
• Solutions:
  • Longformer: Sparse attention (local + global); O(n) complexity
  • BigBird: Sparse random + local + global; O(n) complexity
  • Performer: Random feature approximation; O(n log n)
  • Clinical BERT variants use 512-token limit; longer notes require chunking

---

TOPIC 5: Consumer Health Informatics (CHI)

5.1 Definition and Scope

• Patient portals and PHRs (Personal Health Records)
• Mobile health (mHealth) applications
• Health information websites and online communities
• Wearables and remote monitoring
• Patient-facing decision support tools

---

5.2 Patient Activation

Patient Activation Measure (PAM - Hibbard et al., 2004)

• Definition: Patient Activation = the knowledge, skills, and confidence a person has to manage their own health and healthcare
• Measurement: PAM survey - 13-item validated scale (commercial, Insignia Health)
• Scoring: 0-100 scale; mapped to 4 levels

Why PAM Matters

• Higher PAM levels correlate with: better health outcomes, lower hospitalization rates, better medication adherence, more preventive care
• PAM predicts utilization patterns; higher activation → lower ED visits, lower costs
• PAM informs tailored interventions (meet patient where they are)
• Used in: ACO (Accountable Care Organization) risk stratification, chronic disease management programs

Enhancing Patient Activation

• Motivational interviewing techniques in portal messaging
• Goal-setting features in PHR/portal
• Health coaching (co-produced care plans)
• Peer support communities
• Gamification and feedback in mHealth apps

---

5.3 Digital Patient Portals

Definition

Meaningful Use / Promoting Interoperability (PI) Requirements (CMS)

• Patients must be able to view, download, and transmit their health information
• Portals must offer secure messaging with providers
• Clinical summaries provided after visits

Core Portal Features

OpenNotes

• Movement requiring providers to share full clinical notes with patients via portals
• 21st Century Cures Act (2020): Mandates most providers share all clinical notes (visit notes, discharge summaries, procedure notes, etc.)
• Research shows: Patients who read notes have better medication adherence, better recall of care plan, feel more in control
• Concerns: Note alteration (providers softening language), patient anxiety from medical jargon, privacy risks for documented domestic violence situations

Blue Button Initiative

• CMS Blue Button: Medicare/Medicaid patients download their own claims data
• Blue Button 2.0: FHIR API-based; allows third-party apps to access with patient authorization (SMART on FHIR)
• Enables aggregation of claims data across payers

---

5.4 Health Literacy

Definition (HRSA / Institute of Medicine)

Epidemiology

• ~36% of US adults have basic or below basic health literacy (2003 NALS; 2006 NAAL)
• Low health literacy affects ~80 million Americans
• Disproportionately affects: elderly, less educated, low-income, racial/ethnic minorities, immigrants, persons with disabilities
• "Hidden disability" - patients often ashamed, do not disclose

Impact of Low Health Literacy

• More hospitalizations and ED visits
• Lower preventive care uptake (mammograms, immunizations)
• Difficulty managing chronic diseases (diabetes, hypertension)
• Poor medication adherence and more medication errors
• Higher mortality
• Less engagement with digital health tools

Health Literacy in Digital Context (eHealth Literacy)

1. Traditional literacy (reading/writing)
2. Health literacy
3. Information literacy (finding/evaluating information)
4. Scientific literacy (understanding evidence)
5. Media literacy (understanding media formats)
6. Computer literacy (using digital devices)

Plain Language Standards

• Reading level: Health materials should target 6th-8th grade reading level
• Teach-back method: Ask patients to explain information back in their own words
• Universal precautions approach: Assume all patients may have difficulty; simplify for everyone
• Portal content should follow plain language guidelines (short sentences, active voice, common words, visual aids)

---

5.5 Health Literacy Gaps in Digital Health

Digital Divide Compounding Factors

• Physical access gap: No device, no broadband, high cost
• Skills gap: Cannot navigate portal, app, website
• Literacy gap: Cannot read/understand content
• Trust gap: Concerns about privacy, distrust of health system
• Language gap: Limited English proficiency; content not available in preferred language

Portal Engagement Disparities

• Older adults: lower portal uptake despite internet access growth
• Black and Hispanic patients: lower portal registration and use even when enrolled
• Low-income patients: access barriers plus trust concerns
• Rural patients: broadband infrastructure deficits

Measurement of Health Literacy

---

5.6 Digital Health Equity Frameworks

Definition of Health Equity

Digital Health Equity: Key Frameworks

1. Digital Determinants of Health (DDoH)

• Extends Social Determinants of Health (SDoH) to digital realm
• Digital access, digital literacy, digital trust as upstream determinants of health outcomes
• Proposed inclusion in SDOH screening tools (PRAPARE, HEAL)

2. ONC Health IT Equity Framework (2023)

• Five priority areas: Expand access; Advance the use of health IT to identify and address disparities; Improve quality and safety; Protect privacy and security for underserved; Enable research
• Integrates SDoH data collection into EHRs (USCDI v2+ includes SDoH data elements)

3. Equity by Design Principles

• Inclusive design: Design CHI tools with and for underserved communities, not just tested on them
• Community-Based Participatory Design (CBPD): Involve communities as co-designers
• Algorithmic equity audits: Disaggregate performance metrics by demographic group

4. NASEM Framework for Health Equity in Digital Health (2021)

• Centers trust, access, and usability
• Recommends universal broadband as a social determinant of health
• Calls for representative digital health workforce

Digital Health Equity Interventions

FCC / Federal Broadband Access

• Affordable Connectivity Program (ACP): Subsidized internet access for low-income households (ended 2024; successor programs debated)
• Emergency Broadband Benefit (EBB): COVID-era predecessor
• FCC E-Rate: Subsidizes broadband for schools/libraries (enables digital literacy programs)
• NTIA Broadband Equity, Access, and Deployment (BEAD) Program: $42.5B for broadband infrastructure (Infrastructure Investment and Jobs Act 2021)

---

5.7 CHI Tools and Evidence

mHealth Apps

• Chronic disease management: MyFitnessPal (nutrition), Glucose Buddy (diabetes), Cardiogram (AFib detection)
• FDA oversight of mHealth: Low-risk wellness apps = not regulated; high-risk clinical decision support = SaMD = FDA regulated
• App quality concerns: ORCHA, Happtique - rating frameworks; most consumer health apps lack evidence base

Patient Decision Aids (PDAs)

• Tools to help patients make informed, preference-aligned choices
• IPDAS (International Patient Decision Aid Standards): Criteria for high-quality decision aids
• Examples: Ottawa Decision Guides, ACP Decision Aids

Remote Patient Monitoring (RPM)

• Wearables, implantables, home monitors transmit data to care team
• CPT codes 99453, 99454, 99457, 99458 - RPM reimbursement
• Evidence: RPM reduces CHF readmissions, improves hypertension control
• FHIR-based RPM: Patient-generated data flows into EHR via FHIR APIs

---

5.8 Synthesis: CHI and Patient-Centered Care

Institute of Medicine "Crossing the Quality Chasm" (2001) Aims

• Safe, Effective, Efficient, Timely, Patient-Centered, Equitable
• CHI directly supports Patient-Centered and Equitable aims
• Patient-centeredness = "care that is respectful of and responsive to individual patient preferences, needs, and values"

Triple/Quadruple Aim (IHI)

• Triple Aim: Better health outcomes + Better patient experience + Lower per-capita costs
• Quadruple Aim adds: Improved clinician/staff experience (reduce burnout)
• CHI interventions that succeed address all four dimensions

---

HIGH-YIELD EXAM SUMMARY TABLES

Regulatory Quick-Reference

Self-Attention Formula (Must Know)

Attention(Q, K, V) = softmax(Q · K^T / √d_k) · V
MultiHead = Concat(head_1...head_h) · W_O

HIE Exchange Modalities - One-Line Summary

• Directed: Push from known sender to known receiver (Direct Protocol)
• Query-Based: Pull by receiver from unknown sources (FHIR/XDS query)
• Consumer-Mediated: Patient controls, accesses, shares own records (portal/PHR)

PAM Levels - Memory Aid

• Level 1: "I don't need to manage my health"
• Level 2: "I know I should, but I'm not sure how"
• Level 3: "I'm trying, but it's hard to keep going"
• Level 4: "I stay on top of my health and adapt when things get tough"

AI Bias Types - Memory Framework "PSALMT"

• Proxy variables
• Sampling/selection bias
• Aggregation bias
• Label/annotation bias
• Measurement bias
• Temporal bias

---