The health care industry has always been data driven. Practitioners rely on data to describe and understand conditions and recommend evidence-based treatments. But as more data becomes available, the opportunities – and the risks – increase.
In particular, 'big data' plays a vital role for private health insurers as they continue to look for innovative ways to retain or attract members. Data analytics presents the opportunity turn data into something useful.
Opportunities to use data analytics
Private health insurers are required to comply with the Privacy Act in collecting, using and disclosing personal and health information. Insurers collect member information for the primary purpose of assessing and paying claims.
There are a number of ways data analytics can be used by private health insurers, such as:
- Fraud detection: using data analytics to understand claims patterns and the member base. Both involve the use of information collected from members for a different purpose to that which it was collected. Members would reasonably expect this activity to occur as part of the operations, and so these uses would be consistent with privacy requirements;
- General wellness programs: using data analytics promises the identification of members who are more likely to benefit from targeted programs. If unnecessary hospitalisations can be reduced, it would have a positive impact on member health fund expenses;
- Value based contracting with hospitals and increasingly, with individual medical specialists. Defining value is an important first step in considering reform. It helps to determine if it value is about clinical outcomes alone or patient experiences as well. Defining value and assessing performance is not straight forward and is itself an entire other topic for conversation. Data analytics could be useful to identify those activities that are worth incentivising to achieve value.
Privacy challenges and risks in data analytics
A core challenge in implementing a data analytics project is compliance with Privacy Law.
The regulation of health information is made up of a complex patchwork of principle based State, Territory and Commonwealth Privacy laws. In addition, health records law may apply if linking data with public health records. If the insurer is involved in the European Union, it may also need to comply with the European Union General Data Protection Regulation known as the GDPR.
Any project should start with identifying the data that might be used. Then it should identify the primary purpose for which the information was originally collected. Organisations need to clearly define the use of data in a project so that it can analyse whether there is a legal authorisation to use the information for this second purpose.
There are other challenges organisations may face when using data analytics in addition to Privacy Law.
Data quality issues
There are some limitations on the data that health insurers have, as the data set ordinarily available is limited to hospitalisation and/or allied health services. This means that the insurer does not have a full picture of the health needs of its members. For example, an insurer would not be able to identify a member as being at risk of hospitalisation if they have had five GP visits in the last week and have a chronic condition. The quality of the data set is also impacted by members joining or leaving the fund. This means that there may be very limited longitudinal data for some members. These limitations may tempt insurers to collect additional information from members about factors that are useful in assessing risk – not so that premiums can be personalised (because that is obviously not permitted), but so that other programs aimed at improving health may be developed and assessed.
Outcome assessments
Like with any project, it is important that the outcomes of the intervention are defined at the project planning stage and are able to be measured. Unless a project is used and is effective in improving health outcomes, the project will be an additional cost to the business.
Multiple information sources
A number of health insurers also operate health businesses, for example optometrists or dental clinics. This raises interesting questions about segregation of data and being clear about the circumstances in which data has been collected. Just because it may be the same entity collecting the information does not mean that the information can be shared around the broader business.
Technical issues
These include the manner in which the data is stored, and whether it is able to be easily extracted for a data analytics project.
Member expectation and trust
This is a key overriding consideration for any project. Its importance cannot be overstated. Insurers need to ensure they are aware of the members' expectations in dealing with their data. This is an area that can commonly be answered through stakeholder engagement, and transparency with customers.
Requirements of competition law and the consumer law
The ACCC has become active in commencing proceedings which deal with misleading and deceptive conduct in circumstances where the conduct is likely to constitute a privacy breach. more information is available in Privacy Act Review: Seven key considerations for the healthcare industry.
Navigating the way ahead
It's important to act early to navigate the opportunities and risks around privacy and data analytics. Organisations should take the following steps:
- Undertake a data stocktake to understand what data you have, where it is stored, what was it originally collected for and the legal and environmental constraints;
- Define the problem that you are trying to address through data analytics. This will then lead to the ability to better design and evaluate your success factors using your data;
- Undertake a privacy impact assessment to identify any risks and risk mitigation strategies. Include as part of this stakeholder consultation if the project may be of interest (or concern) to members;
- Develop a data governance framework and stay on track. It's important not to let your project morph into a new project which has not gone through your assessment process.
Our team has helped many organisations undertake privacy impact assessments and develop data governance frameworks. Contact us to find out more about how we can help you.
