Before a hospital builds its own extract
Hospital dataset: what a de-identified hospital extract would hold
Updated
Before a hospital assembles an extract for licensing, the contracts it already signed come first: its EHR, analytics and operations vendors frequently reserved their own rights over de-identified data.
What the vendors reserve
Picis's privacy policy says that to the extent permitted by law it may retain and use anonymous, de-identified and aggregated information for performance reporting, benchmarking, analytics and product improvement. Arcadia's says it may disclose aggregated or deidentified information that cannot reasonably be linked to an individual, and that it contractually requires recipients not to reidentify it.
Where a vendor keeps a use for any lawful purpose
Innovaccer's privacy policy lists among its uses to de-identify and aggregate information and use it for any lawful purpose, and Qventus's says it and its business partners reserve the right to continue using de-identified data indefinitely, even after personal data has been removed. The vendor terms board sets every row side by side.