Data Management Flashcards

A program coordinator discovers that a resident's duty hour logs show 79 hours worked in a given week, but the resident verbally reported 82 hours to the coordinator. ACGME requires programs to maintain accurate duty hour records. Which action BEST reflects proper data management protocol in this scenario?

Answer: Document both figures in the resident's file and flag the discrepancy for the program director to resolve before the record is finalized

Accurate data management requires that discrepancies between logged data and verbal reports be documented and escalated to the program director for resolution before finalization. Arbitrarily choosing one figure, averaging, or bypassing internal review all compromise data integrity and ACGME compliance. The program director must investigate and certify the correct record.

Under FERPA, a residency program receives a subpoena requesting a resident's complete training file, including evaluations and disciplinary records. Which response is MOST consistent with FERPA compliance?

Answer: Notify the resident of the subpoena and give them a reasonable opportunity to seek a protective order before releasing records, unless the subpoena explicitly states otherwise

FERPA requires institutions to make a reasonable effort to notify the student (resident) of a subpoena before complying, unless the subpoena itself orders non-disclosure. Simply complying without notice, partially releasing records, or blanket refusal are all non-compliant responses. The resident must have the opportunity to seek a protective order.

A GME office is transitioning from a legacy paper-based evaluation system to a new electronic platform mid-academic year. Which data management risk is MOST critical to address BEFORE migrating historical records?

Answer: Verifying that all historical records have been authenticated, chain-of-custody documented, and that the legacy system data can be exported in a format preserving original timestamps and authorship metadata

Mid-year migrations carry the risk of data corruption, loss of metadata (timestamps, authorship), and breaks in chain-of-custody — all of which affect the legal defensibility and ACGME auditability of records. UI quality and support are secondary concerns. Faculty consent is not required for institutional record transfers, but data authenticity and integrity are non-negotiable.

A program director asks the coordinator to pull a report showing which residents are 'at risk' based on milestone assessment data, and to share the report with department chairs across specialties for a grand rounds presentation. Which data management concern takes HIGHEST priority before sharing?

Answer: Ensuring the data is de-identified or that appropriate authorization exists, since sharing individually identifiable resident performance data across departments without consent may violate FERPA and institutional policy

Sharing individually identifiable resident performance data with department chairs outside the resident's direct supervisory chain raises significant FERPA and institutional privacy concerns. Unless the data is properly de-identified or written authorization has been obtained, this disclosure could constitute a FERPA violation. Data format and timeliness are secondary to legal and ethical compliance.

An ACGME site visit team requests real-time access to the program's case log database during their visit. The GME information system is cloud-hosted and requires multi-factor authentication (MFA). The site visitor's device cannot complete MFA. What is the MOST appropriate data management response?

Answer: Provide read-only access through a pre-authorized guest or reviewer portal, or have a program staff member present the data on an authenticated device under the site visitors' direction

Security protocols such as MFA must not be bypassed even for accreditation visitors, as doing so creates institutional security and HIPAA-adjacent risks. Creating shared generic credentials violates access control principles. Unencrypted portable media is a data breach risk. The correct approach is to use a guest/reviewer portal with appropriate permissions, or to have an authenticated staff member facilitate access while maintaining security controls.

A training administrator is auditing program data in the ACGME WebADS and notices that a faculty member listed as 'core faculty' has not submitted a single evaluation in 18 months, yet their FTE and scholarly activity fields remain populated and current. Which data management action is MOST appropriate?

Answer: Flag the inconsistency, verify the faculty member's current status and engagement with the program director, and update all affected WebADS fields only after written confirmation — documenting the review process

WebADS data must accurately reflect the program's current state, and inconsistencies between faculty engagement (no evaluations) and listed status (active core faculty) must be investigated. Unilateral deletion or status changes without verification risk removing legitimate faculty or creating inaccurate accreditation records. The correct process is to verify with the program director, obtain written confirmation, update all relevant fields, and document the review — maintaining an audit trail.