Health Information, Analytics, Digital Health and AI

Introduction

Health systems increasingly depend on information infrastructures as much as on hospitals, medicines and health professionals. Reliable information supports surveillance, resource allocation, clinical decisions, quality improvement, financing, research and accountability. Digital health extends this role by connecting patients, providers, communities, payers and regulators through electronic records, mobile platforms, telehealth, decision-support tools and public-health information systems. Artificial intelligence (AI) adds capabilities for prediction, classification, language processing and pattern recognition, but also introduces risks involving bias, opacity, privacy, cybersecurity and misplaced responsibility.

For health-care managers, the central question is not whether a technology is advanced. It is whether it improves health outcomes, equity, safety, efficiency and public value within a governed system. A technically impressive system can fail because data are incomplete, workflows are poorly designed, users are excluded, incentives are misaligned or risks are inadequately controlled.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Distinguish health indicators, administrative data, clinical data and real-world data.
2. Select and interpret indicators for monitoring, evaluation and managerial decision-making.
3. Explain data-quality dimensions, dashboards and basic evaluation designs.
4. Assess interoperability, digital-health architectures and telehealth models.
5. Evaluate AI applications, performance measures, bias and human oversight.
6. Analyse privacy, cybersecurity, safety and governance obligations.
7. Design a practical digital-transformation approach for a health organisation or system.

1. Health Information as a Strategic Resource

Health information is recorded knowledge about health status, determinants, services, processes and outcomes. It differs from raw data: data become information when they are organised and interpreted in relation to a decision. Knowledge develops when evidence is combined with expertise, context and judgement.

A health information system (HIS) is the organised combination of people, processes, technology, standards and institutions that collect, manage, analyse and use health information. It includes national civil registration and vital statistics, disease surveillance, health surveys, facility information systems, electronic health records (EHRs), claims systems, laboratory systems, registries and community platforms.

Information has several managerial functions:

• Planning: estimating population need, workforce requirements and infrastructure capacity.
• Operations: managing appointments, beds, medicines, laboratories and referrals.
• Clinical care: supporting diagnosis, treatment, continuity and safety.
• Public health: detecting outbreaks and monitoring immunisation or maternal mortality.
• Financing: purchasing services, assessing claims and monitoring financial protection.
• Accountability: comparing performance, identifying inequity and reporting results.
• Learning: evaluating interventions and generating evidence for improvement.

Information is valuable only when it is fit for purpose. A perfectly accurate statistic collected too late may be less useful than a timely estimate with known uncertainty. Managers should therefore treat data quality as multidimensional rather than as a single attribute.

Important data sources

Real-world evidence (RWE) is evidence generated by analysing RWD to answer questions about effectiveness, safety, utilisation or value. RWE can complement randomised trials, but it does not automatically establish causality. Treatment selection, missing data and differences between users and non-users can produce confounding.

2. Indicators, Measurement and Interpretation

A health indicator is a measurable variable that provides information about a phenomenon, system or objective. Indicators should be linked to a decision and a defined population, period and denominator. A useful indicator is relevant, valid, reliable, timely, understandable and sensitive to change.

Core types of indicators

• Input indicators: resources, such as nurses per 10,000 population.
• Process indicators: activities, such as the proportion of eligible patients receiving screening.
• Output indicators: immediate products, such as completed consultations.
• Outcome indicators: changes in health or service performance, such as blood-pressure control.
• Impact indicators: long-term population effects, such as avoidable mortality.
• Equity indicators: differences in coverage or outcomes between groups.

A proportion describes a numerator that is part of a denominator:

Here, x is the number with the characteristic and n is the total eligible population. The result may be multiplied by 100 to express a percentage. The denominator must correspond to the population at risk; otherwise interpretation is invalid.

A rate incorporates a time component and usually a population denominator:

Here, k is a multiplier such as 1,000 or 100,000. Incidence concerns new events, whereas prevalence concerns existing cases at a point or during a period. A high prevalence may reflect high incidence, long duration, improved survival or better detection; it should not automatically be interpreted as worsening incidence.

For a binary outcome, sensitivity and specificity are defined as:

TP denotes true positives, FN false negatives, TN true negatives and FP false positives. Sensitivity is the probability that a test is positive among people who truly have the condition. Specificity is the probability that a test is negative among people who do not. Predictive values depend strongly on prevalence and therefore cannot be transferred unchanged between populations.

For comparing groups, an absolute difference is:

and a risk ratio is:

where p₁ and p₀ are risks in the intervention and comparison groups. A relative improvement can appear large when the absolute change is small, so both should be reported.

Data quality

The principal dimensions are accuracy, completeness, consistency, validity, timeliness, uniqueness, integrity and provenance. Data-quality assessment should examine who entered data, when and for what purpose; how variables were defined; whether missingness is random; and whether changes in coding or system design explain apparent trends.

Managers should avoid ranking facilities without risk adjustment. A hospital serving older, poorer or more clinically complex patients may have worse crude outcomes but better risk-adjusted performance. Risk adjustment can improve comparability, but models may also reproduce historical inequities if socially produced differences are treated as patient defects.

3. Dashboards, Analytics and Evaluation

A dashboard is a visual interface that presents selected indicators for monitoring or action. Effective dashboards answer three questions: What is happening? Where and for whom? What action should follow? They should show definitions, denominators, time periods, data freshness, targets and uncertainty where relevant.

A dashboard may contain descriptive, diagnostic, predictive and prescriptive analytics:

1. Descriptive: what happened?
2. Diagnostic: why might it have happened?
3. Predictive: what is likely to happen?
4. Prescriptive: which action may produce a preferred result?

Dashboards can create false confidence. Excessive indicators produce cognitive overload; colour coding can hide small denominators; and league tables can encourage gaming. A good governance process identifies indicator owners, review frequency, escalation rules and the consequences of publication.

Evaluation designs

Evaluation asks whether a programme produced intended results, for whom, at what cost and under what conditions. Randomised controlled trials provide strong internal validity when randomisation is feasible and ethical. In operational health systems, quasi-experimental designs are often more practical:

• Before-and-after studies: simple but vulnerable to secular trends.
• Controlled before-and-after studies: compare change with a similar control group.
• Difference-in-differences: compare changes over time between intervention and comparison groups.
• Interrupted time series: examine whether the level or slope changes after an intervention.
• Stepped-wedge designs: introduce an intervention sequentially across sites.
• Process evaluation: examine implementation fidelity, reach and mechanisms.
• Economic evaluation: compare costs and outcomes, such as cost per quality-adjusted life-year.

For a difference-in-differences estimator:

Y₁ is the intervention group outcome and Y₀ the comparison group outcome. The key assumption is parallel trends: without the intervention, both groups would have followed similar trends. This assumption should be assessed using pre-intervention data. The estimate is not automatically causal if other changes affect groups differently.

A simple cost-effectiveness ratio is:

C₁ and C₀ are costs, and E₁ and E₀ are effects for the new and comparator strategies. Costs and outcomes must use the same perspective, time horizon and discounting assumptions. The ICER is meaningful only when the comparator and outcome measure are clearly specified.

4. Interoperability and Digital-Health Architecture

Interoperability is the ability of systems to exchange, interpret and use information accurately and securely. It has several layers:

• Technical interoperability: networks, interfaces and transport protocols.
• Syntactic interoperability: common message structures and formats.
• Semantic interoperability: shared meaning, terminology and coding.
• Organisational interoperability: aligned workflows, policies and responsibilities.

An interface that transfers a laboratory value but changes “negative” into an ambiguous local code is technically connected but not semantically interoperable. Standards such as HL7 FHIR, terminology systems such as SNOMED CT and LOINC, and imaging standards such as DICOM can support interoperability; adoption still requires governance, mapping, testing and sustained maintenance.

A mature architecture commonly includes:

1. Identity management and patient matching.
2. Source systems such as EHRs, laboratories and pharmacies.
3. An interoperability layer using APIs and event or message exchange.
4. A shared repository, health information exchange or data lake.
5. Analytics, reporting and clinical decision-support services.
6. Security, consent, audit and governance services.

Patient matching is a high-risk function. False matches can expose information or cause clinical harm; missed matches fragment records. Organisations should use validated matching rules, demographic-quality improvement, exception handling and human review for uncertain matches.

Interoperability should be evaluated by use case rather than as an abstract technical goal. A referral exchange requires different data, latency and consent controls from national immunisation surveillance. Open standards can reduce vendor lock-in, but procurement contracts must also address data portability, application programming interfaces, service levels, exit arrangements and intellectual property.

5. Telehealth and Digital Transformation

Telehealth delivers health services at a distance using communication technologies. It includes synchronous video or telephone consultations, asynchronous store-and-forward services, remote monitoring and mobile health interventions. Telehealth is not simply a video version of face-to-face care; it changes triage, documentation, access, professional jurisdiction and continuity of care.

A telehealth service should define:

• eligible conditions and exclusion criteria;
• identity verification and informed consent;
• escalation pathways for emergencies;
• clinical documentation and prescribing rules;
• accessibility for language, disability, connectivity and digital literacy;
• data protection and platform security;
• follow-up, referral and quality monitoring.

Digital transformation is broader than digitisation. Digitisation converts paper into electronic form; digitalisation improves an existing process with digital tools; transformation redesigns services, roles, incentives and decision processes around user and population needs. Successful transformation is socio-technical: technology, people, work design, leadership, regulation and financing must change together.

A useful implementation sequence is to define the problem, map the current workflow, engage users, establish a minimum viable service, test safety and usability, measure outcomes, and scale only when benefits and risks are understood. Interoperability and accessibility should be designed from the beginning rather than added after deployment.

6. Artificial Intelligence in Health Care

AI refers to computational systems that perform tasks associated with human intelligence, including prediction, classification, optimisation, language processing and image interpretation. Machine learning learns patterns from data. Supervised learning uses labelled outcomes; unsupervised learning identifies structure without labels; reinforcement learning optimises actions through feedback. Generative AI produces text, images or other content and requires special controls against fabricated information.

Potential applications include radiology support, deterioration prediction, appointment optimisation, claims anomaly detection, population-risk stratification, clinical documentation and public-health forecasting. The appropriate question is not whether an algorithm has high accuracy in a test set, but whether it improves decisions and outcomes in the intended setting.

Important performance measures include:

Accuracy may be misleading with rare conditions. The area under the receiver operating characteristic curve (AUROC) summarises discrimination across thresholds, but it does not establish clinical utility or calibration. Calibration asks whether predicted probabilities correspond to observed frequencies. A model predicting 0.20 risk should identify groups with approximately 20% observed risk under comparable conditions.

External validation is essential because performance can deteriorate when population, prevalence, equipment, clinical practice or coding changes. Post-deployment monitoring should assess drift, subgroup performance, override rates, adverse events and unintended consequences. A model that is accurate overall may perform poorly for minority groups.

AI governance should address:

• a clearly defined clinical or managerial purpose;
• lawful and ethical data use;
• representative training and validation data;
• transparency appropriate to the risk and audience;
• human oversight and contestability;
• cybersecurity and model integrity;
• documentation of version, data provenance and limitations;
• monitoring, incident reporting and withdrawal criteria.

Automation bias occurs when users accept algorithmic recommendations without adequate scrutiny. Human oversight is meaningful only when the human has competence, time, authority and access to relevant evidence. “Human in the loop” is not a sufficient safeguard if workload or organisational pressure makes disagreement unrealistic.

7. Privacy, Cybersecurity, Bias and Equity

Privacy concerns appropriate control over personal information, including collection, access, use, disclosure, retention and deletion. Key principles include purpose limitation, data minimisation, transparency, accuracy, security, accountability and respect for individual rights. Consent is important but is not a complete governance system: it may be poorly understood, impractical for secondary uses or invalid where power differences are substantial.

De-identification reduces direct identifiers but does not guarantee anonymity. Linkage with other datasets can enable re-identification, especially for rare conditions or location-rich data. Governance should therefore combine technical controls with legal authority, data-access committees, role-based access, audit logs, retention schedules and breach response.

Cybersecurity protects confidentiality, integrity and availability. Health organisations should use defence in depth: asset inventories, secure configuration, multifactor authentication, least-privilege access, encryption, patching, network segmentation, backups, staff training, phishing resistance, vendor assurance and tested incident-response plans. Ransomware can become a patient-safety event when clinical services are disrupted.

Bias may enter through historical inequity, non-representative samples, measurement error, proxy variables, labels based on unequal care, or deployment in a different context. Fairness is multidimensional. Possible assessments include comparing sensitivity, specificity, false-positive rates, calibration and access across groups. Some fairness criteria cannot all be satisfied simultaneously when group prevalence differs; choices must therefore be made transparently and justified by ethical and clinical priorities.

Equity requires more than equal access to an application. Managers should ask who lacks connectivity, devices, language support, disability accommodation, trust or time. Digital exclusion can convert a convenience innovation into a barrier. Hybrid service models, assisted digital access and monitoring by socioeconomic, geographic, age, gender and disability groups can reduce this risk.

8. Governance and Regulation

Digital-health governance allocates authority and responsibility for decisions about data, technology and outcomes. A governance structure should include clinical leadership, information governance, cybersecurity, legal expertise, patient and community representation, data science, procurement and operational management.

A proportionate governance lifecycle includes:

1. Problem definition: specify the unmet need and expected public value.
2. Impact assessment: examine clinical, ethical, equity, privacy and environmental effects.
3. Procurement and design: require interoperability, security, accessibility and auditability.
4. Validation: test technical performance, workflow fit and subgroup effects.
5. Authorisation: define accountable owners and conditions of use.
6. Deployment: train users, communicate limitations and provide support.
7. Monitoring: track outcomes, incidents, drift, complaints and equity.
8. Retirement: archive records appropriately and disable unsafe or obsolete tools.

Regulatory obligations vary by jurisdiction. Medical-device rules may apply to software that makes or supports clinical decisions; data-protection law governs personal information; professional regulation addresses competence and accountability; public procurement law governs purchasing. Managers must not assume that an algorithm is unregulated because it is delivered as software or by a cloud provider.

Accountability should be explicit. Developers are responsible for design and documentation; suppliers for contractual performance and security; deploying organisations for local validation and safe use; clinicians for professional judgement; and leaders for governance and resourcing. Responsibility cannot be transferred to an algorithm.

9. Applied Case: A Regional Telehealth and Predictive-Care Programme

This is a fictional illustrative case.

Background

A regional health authority serving urban and rural communities has high emergency admissions among adults with heart failure. It introduces home monitoring, nurse-led video consultations and an AI model intended to identify patients at risk of admission within seven days.

Problem

After six months, admissions appear to decline in connected urban clinics but not in rural facilities. The dashboard reports high model accuracy, yet nurses report frequent false alarms. Older patients and people with limited broadband are underrepresented in the monitoring programme.

Analysis

The authority first audits data definitions and discovers that “admission” is coded differently across facilities. The model was trained mainly on urban EHR data and uses recent laboratory results that are often missing in rural settings. Missingness is not random: it reflects access and service patterns. The dashboard reports accuracy but not calibration or subgroup performance. A workflow review shows that nurses receive alerts without a prioritisation rule, producing alert fatigue.

A quasi-experimental evaluation compares participating patients with eligible non-participants while adjusting for baseline risk, and conducts sensitivity analyses for unmeasured confounding. A qualitative study explores patient burden, digital exclusion and clinician trust. The authority also performs a privacy impact assessment and reviews vendor access to identifiable data.

Approach and solution

The programme changes its design in five ways. First, it establishes a common admission definition and data dictionary. Second, it validates the model separately in urban and rural populations and recalibrates probabilities where necessary. Third, it introduces a nurse-confirmation step and a high-risk escalation protocol rather than automatic clinical action. Fourth, it offers telephone and community health-worker alternatives for people unable to use remote monitoring. Fifth, procurement contracts require data portability, breach notification, audit rights and deletion at contract termination.

Outcome

After twelve months, alert volume falls while sensitivity for high-risk patients remains acceptable. The authority reports absolute admission differences, confidence intervals, subgroup results, patient experience and implementation costs rather than claiming that the algorithm alone caused improvement. Rural participation increases after assisted access is introduced. The programme continues under quarterly safety and equity review.

Learning points

The case demonstrates that digital transformation is a system intervention. Data harmonisation, workflow design, equity, evaluation and governance were as important as the model itself. High predictive performance in development data did not guarantee usefulness in practice. A credible programme measured outcomes, harms, access and cost together.

10. Best-Practice Checklist for Managers

Before approving a digital or AI-enabled intervention, managers should ask:

• What decision or service problem is being addressed?
• Which population is included and which may be excluded?
• Are the numerator, denominator and outcome definitions explicit?
• Are data provenance, quality and missingness understood?
• Can systems exchange and interpret the required information?
• Is the intervention validated in the intended context and subgroups?
• What happens when the system is wrong, unavailable or attacked?
• Who can access data, for what purpose and for how long?
• Can patients and professionals understand, challenge or opt out where appropriate?
• What measures will determine continuation, modification or withdrawal?

Contemporary Developments

Current health systems are moving toward cloud-based infrastructure, national data exchanges, patient-access applications, federated analytics, synthetic data, ambient documentation and generative AI. Federated approaches may allow analysis near the data source rather than centralising all records, but they do not eliminate privacy or governance risks. Synthetic data can support development and testing, yet synthetic records may reproduce the biases of the source data and should not be assumed to be risk-free.

Generative AI may reduce administrative burden through summarisation and drafting, but it can generate confident inaccuracies, expose sensitive information or obscure authorship. High-risk uses require source verification, restricted prompts, clear accountability and evaluation of time saved versus new review work. The future of digital health will depend less on isolated technological breakthroughs than on trustworthy institutions capable of learning, regulating and redesigning services.

Chapter Summary

Health information is a strategic resource for clinical care, public health, financing, planning and accountability. Its value depends on fitness for purpose, including accuracy, completeness, timeliness, validity, security and equitable coverage. Indicators require precise numerators, denominators, populations and time periods; dashboards should support action rather than merely display data.

Administrative, clinical, survey, registry, device and real-world data have different purposes and limitations. Evaluation methods must match the question, with randomised and quasi-experimental designs interpreted through their assumptions. Interoperability includes technical, syntactic, semantic and organisational dimensions, and standards alone cannot resolve poor governance or workflow design.

Telehealth and digital transformation are socio-technical changes affecting access, professional practice and accountability. AI can support prediction and decision-making, but managers must assess discrimination, calibration, external validity, drift, explainability, automation bias and clinical utility. Privacy, cybersecurity, safety, fairness and inclusion must be designed into systems. Effective governance establishes clear responsibility throughout the technology lifecycle and measures outcomes, harms, cost and equity together.

Key Terms

Health information system: People, processes, technologies and institutions that manage health information.

Health indicator: A measurable variable used to describe or monitor a health phenomenon or objective.

Administrative data: Routine data generated through service delivery, payment or management.

Real-world data: Data collected during routine practice rather than exclusively in controlled research.

Real-world evidence: Evidence derived by analysing real-world data.

Data quality: The degree to which data are accurate, complete, valid, timely, consistent and fit for purpose.

Dashboard: A visual interface presenting selected measures for monitoring and action.

Interoperability: The ability of systems to exchange, interpret and use information.

Semantic interoperability: Preservation of shared meaning across systems.

Telehealth: Delivery of health services at a distance through information and communication technologies.

Digital transformation: Redesign of services, processes and relationships using digital capabilities.

Artificial intelligence: Computational capability for tasks such as prediction, classification or language processing.

Machine learning: Methods that learn patterns or relationships from data.

Calibration: Agreement between predicted probabilities and observed frequencies.

Algorithmic bias: Systematic, unfair differences in performance or effect associated with data, design or deployment.

Privacy: Appropriate control over the collection, use, disclosure and retention of personal information.

Cybersecurity: Protection of systems and information from unauthorised access, disruption or alteration.

Difference-in-differences: A quasi-experimental estimator comparing changes over time between intervention and comparison groups.

Data governance: The authority, rules and processes governing data decisions and accountability.

Digital exclusion: Disadvantage arising from unequal access to devices, connectivity, skills or usable digital services.

Review Questions

Short Answer Questions

1. Distinguish incidence from prevalence and explain why prevalence may rise even when incidence is stable.
2. Identify four dimensions of interoperability.
3. Why can accuracy be misleading when an AI model predicts a rare condition?
4. State three essential controls for protecting health information.
5. Explain why digitisation is narrower than digital transformation.

Long Answer Questions

1. Compare administrative data, EHR data, surveys and registries in terms of purpose, strengths and limitations.
2. Explain how a health authority should design and govern a performance dashboard.
3. Discuss the principal requirements for safe and equitable telehealth implementation.
4. Explain the lifecycle governance of an AI system used in clinical decision support.
5. Critically assess the relationship between interoperability, vendor procurement and health-system performance.

Analytical / Application Questions

1. A screening programme identifies 90 true positives, 10 false negatives, 180 true negatives and 20 false positives. Calculate sensitivity and specificity, and explain which measure is most relevant if missed cases have severe consequences.
2. A digital intervention changes hospital admissions from 30% to 24% in participating sites and from 28% to 26% in comparison sites. Calculate the difference-in-differences estimate and interpret its limitations.
3. Design an evaluation and governance plan for an AI model that prioritises patients for community follow-up, including data quality, subgroup equity, privacy, cybersecurity, human oversight and stopping rules.

Multiple Choice Questions with Answers

Question 1

Which statement best describes semantic interoperability?

A. Systems use the same network connection.

B. Systems exchange data using identical hardware.

C. Systems preserve a shared meaning when exchanging information.

D. Systems store all data in one central database.

Correct Answer: C. Systems preserve a shared meaning when exchanging information.

Question 2

If a screening test has TP = 90 and FN = 10, what is its sensitivity?

A. 80%

B. 90%

C. llam100%

D. 10%

Correct Answer: B. 90%

Question 3

Which indicator type measures the immediate products of a health service?

A. Input

B. Process

C. Output

D. Impact

Correct Answer: C. Output

Question 4

What is a central assumption of difference-in-differences analysis?

A. The intervention group has no missing data.

B. The groups would have followed parallel trends without the intervention.

C. The outcome must be binary.

D. Randomisation occurred before implementation.

Correct Answer: B. The groups would have followed parallel trends without the intervention.

Question 5

Why may a model with high overall accuracy still be unsafe?

A. Accuracy is never useful.

B. It may perform poorly for important subgroups or rare conditions.

C. Accuracy measures only cybersecurity.

D. High accuracy proves causation.

Correct Answer: B. It may perform poorly for important subgroups or rare conditions.

Question 6

Which practice best supports cybersecurity in a health organisation?

A. Sharing administrator passwords among staff

B. Disabling audit logs to improve speed

C. Using multifactor authentication and least-privilege access

D. Keeping unsupported software indefinitely

Correct Answer: C. Using multifactor authentication and least-privilege access

Question 7

What does calibration assess in a predictive model?

A. Whether predicted probabilities correspond to observed frequencies

B. Whether the model uses the fastest computer

C. Whether all variables are normally distributed

D. Whether the model has a graphical interface

Correct Answer: A. Whether predicted probabilities correspond to observed frequencies

Question 8

Which is an example of digital exclusion?

A. A patient receiving a reminder by text

B. A patient lacking connectivity and therefore unable to use a required online service

C. A clinician reviewing an electronic record

D. A hospital using encrypted backups

Correct Answer: B. A patient lacking connectivity and therefore unable to use a required online service

Question 9

Which statement about de-identification is most accurate?

A. It guarantees that re-identification is impossible.

B. It removes the need for access controls.

C. It reduces direct identification but may not prevent re-identification through linkage.

D. It makes data unsuitable for every research purpose.

Correct Answer: C. It reduces direct identification but may not prevent re-identification through linkage.

Question 10

Which governance action is most appropriate before deploying an AI clinical-support tool?

A. Deploy immediately if the vendor reports high accuracy.

B. Validate it in the intended population and define human oversight and monitoring.

C. Allow the model to replace all professional judgement.

D. Avoid documenting model limitations.

Correct Answer: B. Validate it in the intended population and define human oversight and monitoring.