consumer privacy using hitsp tp30 john moehrke – ge healthcare co-chair hitsp...
TRANSCRIPT
Consumer Privacyusing HITSP TP30
John Moehrke – GE Healthcare• Co-Chair HITSP Security/Privacy/Infrastructure • Co-Chair HL7 Security Workgroup• Member IHE IT Infrastructure Committee• Blog – http://healthcareSecPrivacy.blogspot.com
October 20, 2010
Focus
• Electronic standards for privacy, not so much security
• Interoperability between systems, not so much within internal systems
• Applicability to EHRs, PHRs and HIEs• Capabilities to capture, exchange and execute privacy
consents, authorizations, directives and preferences
2
Basic Concepts• What is Privacy (of health information)?
– An individual's (or organization's) right to determine whether,
what, when, by whom and for what purpose their personal
health information is collected, accessed, used or disclosed
• What is Security (of health information)?– A defined set of administrative, physical and technical actions
used or taken to protect the confidentiality, availability and
integrity of health information
Source: HITSP Vocabulary – modified and expanded from 45 CFR 164.304
Privacy of Health Information – Important Underlying Realities
• Medical records among the most sensitive information about a person
• Health care is an information-driven field• Information is much more complex than other
industries (amount, type, frequency)• Once exposed, can’t be revoked
Health information is central to the doctor-patient relationship
Privacy and security of health information are central to the doctor-patient relationship
• Health care is a complex system, when it comes to health information– Many actors (patient, provider, health plan,
employer, government, public health, researchers, vendor, etc)
– Various types of information (demographic, clinical, financial)
– Many processes related to health information (collection, creation, maintenance, access, use, disclosure)
– Different purposes (treatment, payment, operations, public health, research, judicial, legal, etc)
– Many places where health information reside– Lack of common identifiers and other standards
Privacy of Health Information – Important Underlying Realities
• Inter-jurisdictional Portability
– Consumer privacy consent laws and requirements, and consumer privacy desires and directives in one jurisdiction may not be legally applicable/enforceable in another jurisdiction
• An entity operating in one jurisdiction uses and discloses health information based on its own policies and procedures, created to meet consent requirements under that jurisdiction
• When information is disclosed to a different entity in another jurisdiction, the receiving entity applies its own policies and procedures to the received data, which where created to meet consent requirements under the receiving entity’s jurisdiction
Privacy of Health Information – Portability Issues
• Cross-validation and verification of conflicting consents
– What is the most recent/latest consent from a patient?
– Does that override other consents for specific data, specific purpose?
– Where can I find the various consents issued by a consumer to perform cross-validation and verification?
Privacy of Health Information – Cross-validation Issue
• A Consent Directive is a record of a consumer’s privacy policy, in accordance with governing jurisdictional and organization privacy policies, that grant or withhold consent:– To one or more identified entities in a defined role – To perform one or more operations (e.g., collect, access, use, disclose,
amend, or delete)– On an instance or type of health information– For a general or specific purpose, such as treatment, payment, operations,
research, public health, quality measures, health status evaluation by third parties, or marketing
– Under certain conditions (e.g., when unconscious)– For specified time period (e.g. effective and expiration dates)– In certain context (e.g., in an emergency)
Electronic Standards for Consumer Consent– What are Privacy Consent Directives?
9
Most consumer privacy consent/authorization still conducted via paper forms General consumer privacy consent
offered at initial point of care/enrollment (when required)
Additional patient consent/authorization used for specific types of health information, specific disclosure purposes (when required)
No standard paper consent forms within a jurisdiction (national, state)
Each organization/program has its own forms
Some States beginning to establish a standard ‘reference’ form (i.e. MN)
Consent/Authorization – Current Practices
10
EHRs Specific screens and ‘forms’ used within the EHR to capture
various consumer consents Informed consent (for treatment) Release of Information Authorization (i.e., payment purposes) Authorization for other disclosures, when required
Some data ‘flagged’ by EHR due to sensitivity Defined by organization and customized by vendor Based on specific laws that afford special protections to certain data
Consumer signature captured via digital pad or through consumer acknowledgment (“…click here to accept…”)
Consent/Authorization – Current Practices
11
PHRs (vendor-provided) Consumer controls all information added
to the PHR, accessed or disclosed “EULA” or “Agree to Terms” screen Additional authorizations used for
specific disclosures
HIEs Opt-in / Opt-out approach
General Opt-out General Opt-in (all-or-nothing) Opt-in with Specific Restrictions
Consent/Authorization – Current Practices
12
Offer consumers and the health care industry
an interoperable, standard-based electronic mechanism to
collect/capture, maintain, report/ transfer/exchange and
act/execute consumer consent directives and preferences, in a
manner that allow users to meet different types of jurisdictional
requirements and organizational policies
Electronic Standards for Consumer Consent A New Paradigm
13
Consumer-friendly mechanism To allow consumer to manage their consent preferences and
directives electronically in a simple, reliable, secure, efficient and effective manner
Scalable Allow to go from General (overall opt-in/opt-out) to Granular (specific
data, specific people, specific people)
Codifiable Uses standard codes to express consent directives
Machine-readable/Machine-actionable Does not require human intervention to process Allow systems to operationalize access, use and disclosure controls
Electronic Standards for Consumer Consent– Key Characteristics
14
Portable/Transferable/Interoperable Uses interoperable standards that allow it to be electronically
ported/transferred between organizations and across jurisdictions
Flexible/Adaptable Supports different jurisdictional requirements Features can be ‘turn-on’ or ‘turn-off’ based on differing
levels of requirements and organizational policies
Valid/Verifiable/Auditable Supports digital signature, non-repudiation, audit controls
Unambiguous/Completeness Conflicts between directives can be identified and resolved
Electronic Standards for Consumer Consent– Key Characteristics
15
From Privacy Consent to Comprehensive Consent Management
Consent/Authorization
Consumer Privacy Preferences
Consent Directives
Access Control Policies
Consent Management System
Interoperability – The Focus of HITSP
Internal SecurityPolicies, Procedures
and Practices
Secure System Architecture
Internal SecurityPolicies, Procedures
and Practices
Secure System Architecture
Inter-organizationalExchange
Security Privacy
Infrastructure
Intra-organizationalSecurity, Privacy, Infrastructure
Intra-organizationalSecurity, Privacy, Infrastructure
17
Integrating the Healthcare Enterprise, a world-wide consortium of vendors and health care organizations (www.ihe.net)
Developed the BPPC Profile = Basic Patient Privacy Consent Most widely recognized standard ‘profile’ for capturing and
sharing privacy preferences within an affinity domain (i.e., an HIE) Provides the mechanism to:
Record the patient privacy consents Mark documents with the patient privacy consent Enforce the privacy consent appropriate to the use
Leverages the same Transport mechanism as the Clinical Documents
IHE
18
BPPC uses Object Identifiers (OIDs) to codify the privacy preferences within an affinity domain (i.e., HIE)
The affinity domain (exchange) defines the consent policies and each is identified with an OID
Organizations within the affinity domain offer the consent policy options to consumers
Consumers makes privacy preferences based on consent policies offered
Consumer Consent Acknowledgement is captured in a CDA document (the BPPC profile) and published like any other HIE document
IHE - How BPPC works:
19
Opt-In to clinical use Opt-Out of sharing outside of local event use, allowing emergency override Opt-Out of sharing outside of local event use, without emergency override Specific document is marked as available in emergency situations Additionally allow specific research project Additionally allow specific documents to be used for specific research
projects Limit access to functional roles (eg: healthcare) (direct care) providers Limit access to structural roles (eg: organizational) (radiologist, cardiologist) Allow direct use of the document, but not allowed to re-publish when the document is published on media when the document is published point-to-point when the document is retrieved across communities individual policy for opt-in at each clinic individual policy for opt-in for a PHR choice (choosing from all possible PHRs)
IHE - Types of Policies Supported
Written Policy Example
20
The patient agrees to share their healthcare data to be accessed only by doctors wearing a chicken costume.
Basic Patient Privacy Consents• Human Readable• Machine Processable• Supports standards-based Access Controls• Multiple Consent Types and Documents (e.g., HIPAA)
– Opt-in or Opt-out– Implicit or Explicit – Time Limited
• Wet Signature Capture (i.e. XDS-SD)• Digital Signature Capture Possible (i.e. DSG)
– Provider, Witness, Patient or Legal Representative• Extensible
• Scanned Document details• Privacy Consent details
• Policy 9.8.7.6.5.4.3.2.1
SSttrruuccttuurreedd CCoonntteenntt wwii tthh ccooddeedd sseecctt iioonnss::
Structured and Coded CDA Header
Time of Service, etc.
Base64 encoded
BPPC + XDS-SD
Patient, Author, Authenticator, Institution,
XDS Metadata:
Consent DocumentDigital Signature
IHE-DSG – Digital SignatureSignature valuePointer to Consent document
Consent document
23
All Clinical Documents are Published with Metadata sensitivity classification (aka ConfidentialityCode)
All Users identified with Roles Access Permissions Users can be clinical, financial, operational, research, patient, guardian,
etc (See IHE XUA)
When a User requests access to a resource an Access Control decision YES/NO User Rights, Physical Location Purpose of Use, Data sensitivity classification Current Consent/Authorizations
Enforcing Policy (aka HITSP TP20)
24
Access Control: UML Activity Diagram
Patient ID Manager
Document Registry
Document Repository
HIE
Complex Patient Privacy Policy Enforcement
PCP gets HIV History
PCP Security Domain 1
3.
Submits psychiatristReferral
4.
Mental Specialist Security Domain 2
Specialistgets allHistory5.
SpecialistsubmitsrestrictedMental Eval
6.
PCP does notget restrictedMental Eval
7.
Emergencycare teamgets all doc
Hospital Emergency Security Domain 4
9.
DieticianSpecialist Security Domain 3
8.
Dietician does not get HIV results or Mental Eval
Lab TestSecurity Domain 1
Lab publishesHIV Results
2.
1.PatientSecurity Domain 1
PatientHIE ConsentOpt-in
HHS Whitepaper on Consent (March 2010)
• No consent. Health information of patients is automatically included—patients cannot opt out;
• Opt-out. Default is for health information of patients to be included automatically, but the patient can opt out completely;
• Opt-out with exceptions. Default is for health information of patients to be included, but the patient can opt out completely or allow only select data to be included;
• Opt-in. Default is that no patient health information is included; patients must actively express consent to be included, but if they do so then their information must be all in or all out; and
• Opt-in with restrictions. Default is that no patient health information is made available, but the patient may allow a subset of select data to be included.
26