First of all, Ocean is not an EMR/EHR and not a long term repository of health information for a patient. All patient records are eventually deleted from Ocean. It only holds encrypted patient records for a limited time to support the various ways clinics use Ocean.
For example, if a patient is coming in for an appointment, the patient record is encrypted and uploaded into Ocean a day or two before their appointment time, and then it is deleted after the EMR downloads the generated note. Total time in Ocean might be 3-4 days.
For a contrasting example, if a newly pregnant patient registers for a new baby pediatric appointment, the patient might be sent an Ocean Online web questionnaire months prior to the birth and be asked to complete the form upon delivery. In this case, the patient record might be stored in Ocean for 5 months.
There are a few reasons we do it this way. First of all, privacy guidelines recommend that PHI be kept in as few places as possible for as short a time as possible; the master copy for clinics is generally the EMR. Second, the patients in Ocean are "snapshots" of a patient at a point in time (when the patient was uploaded). Although the patients can be updated by the EMR/EHR easily, having multiple copies of patient records is generally problematic.
- You can "lock" a patient in Ocean to request that Ocean leave the record alone and stored within Ocean, although this should be reserved for special situations only.
- Ocean Study data captured for a patient is kept indefinitely (until it is deleted by the owning Ocean site).
- The audit trail maintained by Ocean lives indefinitely, which allows you to map the EMR ID of the patient to an Ocean reference number to tablet access, web questionnaire access, form completion audit records, etc. for audit purposes.
- Encrypted PHI will be maintained in Ocean database backups for up to one year. Ocean backups are maintained at a secure facility with all access logged. Access is limited to CognisantMD operations staff.
Detailed time frames in which PHI is kept within Ocean:
- For patients with forms pending: 30 days
- For patients with notes that haven't been downloaded: 90 days (if you have patients in this situation, the following will occur: "What do I do if I see 'Warning from Ocean: Notes Require Download?'")
- For patients that have all notes downloaded and no forms pending: 14 days
- For patients with a scheduled appointment with no forms or updates pending: 14 days after their scheduled appointment date
For eReferrals and Website Form Submissions:
- Ocean eReferrals and Website Form Submissions are kept for 60 days in the "New" folder.
- If accepted, the retention time becomes 365 days from the creation date.
- If an appointment is scheduled, the referral is retained until the appointment date plus 30 days.
- If an estimated wait time is entered, the referral is retained until the end of the date range.
- When an eReferral or Website Form Submission is scheduled for deletion, it moves to the "Deletion Warnings", which appears in red. A user can "extend" the retention time for additional blocks of 60 days.
- As above, Ocean will notify you with an alert if you have deletion warnings.
- eReferral analytic data captured by Ocean is kept indefinitely.
- More details about lifetime of eReferral storage can be found in: "How long will my eReferrals be stored in Ocean?".
- Both patient-authenticated website form submissions (sometimes called "patient inbound messages") and ordinary, unauthenticated website form submissions use the same retention rules outlined above.