The Health Information Security and Privacy Collaboration (HISPC) brought stakeholders from several states together to address and make recommendations on the privacy and security challenges in HIE, with the goal of identifying replicable steps that can build patient understanding and trust in HIE. Many communities have taken the recommendations and customized them to address the particular needs of their states to inform patients about HIE privacy, security and confidentiality policies, how complaints will be handled, how individuals will be informed of a violation and existing remedies available to them³. A review of several HIE specific materials identified key themes:

• Make the principles available in plain language
• Make the policies available in multiple mediums: print brochures, websites with information including self-directed tutorials
• Develop FAQs and a glossary of terms
• Utilize media to amplify the message to the larger public: posters, print ads, PSAs, videos
• Consider the literacy levels and languages spoken by the patients receiving the information
• Develop a process to measure and improve on the effectiveness of patient education about privacy and security policies

HISPC Literacy and Language Guide

CORHIO Fact Sheet for Consumers (English)

CORHIO Fact Sheet for Consumers (Spanish)

Georgia Privacy Glossary

Oregon Privacy Education Video

Kansas Evaluation Plan

NeHII Patient Brochure

In addition to these self-directed efforts, HIOs also have the opportunity to participate in the EHNAC Health Information Exchange Accreditation Program. While Utah Health Information Network is the only accredited HIE there are several HIOs applying for this independent accreditation of their adherence to privacy and security regulations, across three domains: technical performance, business processes, and resource management. HIO communication to patients about the voluntary accreditation offers another opportunity to convey that patients can learn about the HIE policies as measured by a third party. In addition, at least one state, Minnesota, requires that HIEs operating in their state be certified. Currently, the HIE-Bridge, operated by the Community Health Information Collaborative, is the only HIE to receive such certification.