Key Elements: Managing Privacy, Security & Confidentiality

Confidentiality, Privacy & Security workgroup

Broad Charge:
Make recommendations to the Community regarding the protection of personal health information in order to secure trust, and support appropriate interoperable electronic health information exchange.

Specific Charge:
Make actionable confidentiality, privacy, and security recommendations to the Community on specific policies that best balance the needs between appropriate information protection and access to support, and accelerate the implementation of the consumer empowerment, chronic care, and electronic health record related breakthroughs.

Workgroup will address the following issues:

• Methods of patient identification
  
• Methods of authentication
  
• Methods for securing data
  
• Methods for securing access to health information
  
• Policies for breach of health information
  
• Guidelines and processes to determine appropriate secondary uses of information
  
• A scope of work for a long term independent advisory body on privacy and security issues.

Invitational Conference on Secondary Use of Health Data

Develop a national framework for the secondary use of health data that includes:

• A taxonomy describing types of uses and users of health data
  
• Guiding principles that balance the risk, sensitivity, benefits, obligations, and protections of various uses of health data
  
• Clarifications of terminology associated with various uses of health data

Data Stewardship Principles:

1. Accountability (including governance, oversight , and level of applicable regulations)
   
2. Openness and transparency (including structure, processing and delivery of data, and business processes and practices)
   
3. Notice to patients
   
4. Privacy and security (including data quality, de-identification, and costs of re-identification)
   
5. Granularity of patient consent
   
6. Permitted uses and disclosures (including data aggregation and analyses)
   
7. Enforcement and remedies
   

The Common Framework

A new infrastructure for health information sharing will provide the foundation for a transformed, 21st century healthcare system in which patients and families can better understand their own health and engage more fully in their care through direct access to their own health information.

Policy Principles:

1. Openness and transparency
   
2. Purpose specification and minimization
   
3. Collection limitation
   
4. Use limitation
   
5. Individual participation and control
   
6. Data integrity and quality
   
7. Security safeguards and controls
   
8. Accountability and oversight
   
9. Legal and financial remedies
   

Technology Principles:

1. Make it ?Thin?
   
2. Avoid ?Rip and Replace?
   
3. Separate Applications from the Network
   
4. Decentralization
   
5. Federation
   
6. Flexibility
   
7. Privacy and Security
   
8. Accuracy
   

Consumer Coalition for Health Privacy

To inform and empower the consumer community, including the disabled and those with serious illnesses, to more fully engage in the national and local debate on health privacy.

Principles ? Committed to the development and enactment of public policies and private standards that:

• Guarantee the confidentiality of personal health information
  
• Promote both access to high quality care and the continued viability of medical research.

Health Privacy Project

To raise public awareness of the importance of ensuring health privacy in order to improve health care access and quality, both on an individual and a community level.

Principles (as identified in the Best Principles for Health Privacy report):

• For all uses and disclosures of health information, health care organizations should remove personal identifiers to the fullest extent possible, consistent with maintaining the usefulness of the information.
  
• Privacy protections should follow the data.
  
• An individual should have the right to access his or her own health information and the right to supplement such information.
  
• Individuals should be given notice about the use and disclosure of their health information and their rights with regard to that information.
  
• Health care organizations should implement security safeguards for the storage, use, and disclosure of health information.
  
• Personally identifiable health information should not be disclosed without patient authorization, except in limited circumstances.
  
• Health care organizations should provide patients with certain choices about the use and disclosure of their health information.
  
• Health care organizations should establish policies and review procedures regarding the collection, use, and disclosure of health information.
  
• Health care organizations should use an objective and balanced process to review the use and disclosure of personally identifiable health information for research.
  
• Health care organizations should not disclose personally identifiable health information to law enforcement officials, absent a compulsory legal process, such as a warrant or court order.
  
• Health privacy protections should be implemented in such a way as to enhance existing laws prohibiting discrimination.
  
• Strong and effective remedies for violations of privacy protections should be established.

National Consumers League

Health Information Privacy Policies:

• Right to privacy
  
• Informed consent and notice
  
• Security safeguards and penalties
  
• Individual right to access
  
• Right to private access
  
• Research access
  
• Education
  
• Consumer information programs

Health Information Security and Privacy Collaboration
(HISPC) Toolkit

To create long-lasting collaborative networks in states and communities to support future work and inform future health information exchange activities.

Obtaining Interoperable HIE:

1. Identify the variations in organization-level business privacy and security policies and practices and state laws that affect electronic HIE.
   
   
2. Engage stakeholders in discussions where they can come to agreement on the common and necessary elements of current practices that will need to be retained and to identify gaps in current protections that are inadequate to cover the requirements for electronic HIE.
   
   
3. Identify the policy or legal driver or other underlying rationale for the current practice and work toward identifying consensus-based solutions.
   
   
4. Develop a plan to implement the solutions.
   
   
5. Work through the implementation process, collaborating openly with stakeholders.

Patient Privacy Rights Foundation

To guarantee that all Americans control access to their health records.