In 2008, ONC released a nationwide privacy and security framework for the electronic exchange of individually identifiable information. This document continues to serve as a resource for HIEs working to develop clear, consistent and coordinated approach to privacy and security.

The Framework is based on Fair Information Practice Principles, including limitations on collection of data, data quality, purpose specification for the data collected, use limitations, security safeguards, openness, individual participation, and accountability. In 2008, the Department of Homeland Security published a guidance memorandum on the subject.

Since 2008, activities in several areas are advancing the national privacy and security framework. ONC created the State Health Information Exchange Cooperative Agreement Program, and entered into cooperative agreements with 56 territories and State Designated Entities (SDEs) to coordinate and facilitate HIE within their state. The SDEs must address legal and regulatory issues, including the requirements for privacy and security in the context of facilitating HIE within their state and exchange with other states. SDEs will establish a statewide privacy framework, implement an enforcement mechanism to address non-compliance with privacy and security requirements, review of legal and policy obstacles to information exchange, and establish policies and frameworks for services.

SDEs are required to support the health professionals and hospitals within their jurisdiction in meeting meaningful use requirements. They are expected to facilitate increased connectivity and enable patient-centric information flow to improve the quality and efficiency of care within their state. HIOs, working with the SDEs to enable HIE, also should be aware of the meaningful use requirements, specifically the requirements that support the adequacy of privacy and security protections for PHI. Meaningful use objectives are expected to increase over time. The capacity of technology to support any increased privacy and security requirements is being considered and the expectation is that technology will evolve to meet new requirements. The efforts of SDEs to advance their respective privacy frameworks and doing so within the context of supporting meaningful use will be one activity that advances the national privacy and security framework, and HIO practices must remain aligned with this activity.

More changes are ahead: the Federal Trade Commission and the Department of Commerce each issued requests from the public on questions of data information sharing practices, which may result in regulations that affect HIE. With the rise of social media, technologies that enable direct patient capture and sharing of health information will change the HIE landscape. In short, the evolution of requirements governing health information is likely to evolve in a manner that continues to focus on the type of information more than the place where the information resides.