The National Institute of Standards and Technology (NIST) and the Department of Health and Human Services (HHS), Office for Civil Rights (OCR) co-hosted the 6th annual conference Safeguarding Health Information: Building Assurance through HIPAA Security on May 21 & 22, 2013. The conference explored the current health information technology security landscape and the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. This event highlighted the present state of health information security, and practical strategies, tips and techniques for implementing the HIPAA Security Rule. The Security Rule sets federal standards to protect the confidentiality, integrity and availability of electronic protected health information by requiring HIPAA covered entities and their business associates to implement and maintain administrative, physical and technical safeguards.

At the conference OCR Director Leon Rodriguez provided an overview to the new impact of the Omnibus HIPAA Rulemaking and highlighted OCR’s commitment to enforcement, audit and education initiatives in the coming year.



Discussing the tension between patient access to patient information and an organization’s safeguarding of protected health information (PHI) inherent in HIPAA, Director Rodriguez characterized OCR’s HIPAA guidance as providing the “super highways” to ensuring patient access as well as privacy and security. An organization must first figure out the “surface streets.” To adequately safeguard PHI, HIPAA defines a process and provides an organization with a series of decisions, policies and procedures, analyses, and plans. Patient expectations are what govern.

The key factors of the he size of a penalty for HIPAA violations are the lack of a timely risk assessment and the failure to address ongoing security issues. Failure to take action quickly ratchets up the penalties," he said. As an example, he pointed to a $1.7 million settlement last year with the Alaska Department of Health after an investigation of a relatively small breach incident that uncovered bigger issues. "The issues of the underlying breach went on for a year after the breach - that's why the fine was so big," he stated. OCR has a tool on their website which posts all breaches of more than 500 individuals.

Director Rodriguez acknowledged that breaches of PHI are certainly going to occur, and that risks exist even where organizations are doing everything right. OCR is interested in what an organization is not doing, and whether the proper security analysis is being conducted. An organization must identify, remedy and then if necessary change. He also also commented on the vulnerabilities associated with mobile devices, which remains a topic of interest for OCR. Of the breach reports received by OCR, 25% are related to paper records and vulnerability of mobile devices. Director Rodriguez encourages all organizations to focus on securing mobile devices, which he termed a “great vulnerability,” and to use HHS resources regarding mobile device security.

He concluded by saying that we must "Be smart and implement best practices, and conduct ongoing risk analysis." And remember that the patient is most important and should be at the center of our thinking. Organizations must determine how to best ensure patient access to PHI while also adequately safeguarding PHI. "A risk analysis, ongoing risk management, and routine information system reviews are the cornerstones of an effective HIPAA security compliance program," he said.

Earlier in the event there was a panel discussion with Deven McGraw, Center for Democracy & Technology (Co-Chair, Tiger Team); Walter Suarez, Kaiser Permanente, (Co-Chair, Privacy & Security Working Group, HITSC); Peter Tippett, Chief Medical Officer, Verizon; Elizabeth Franchi, Director, Veterans Health Administration Data Quality Program; Paul Uhrig, Chief Administrative, Legal & Privacy Officer, Surescripts. The slide deck is below:


Continue reading
    Share:
Failure to use linked electronic health records may lead to biased estimates of heart attack incidence and outcome, warn researchers in a paper published in the British Medical Journal (BMJ).


They show that up to 50% of all heart attack cases are missed using just one data source. These findings may be relevant to other common conditions, such as stroke, and support the wider use of linked multiple record sources by clinicians, policy makers and researchers, say the authors.

Electronic health records are increasingly used to measure health outcomes, and for research, but records from one part of the health service (e.g. primary care) may not capture health events occurring in other parts of the health system (e.g. hospital care).

So a team of researchers from the London School of Hygiene & Tropical Medicine and UCL compared electronic health records for one major disease event – heart attack (myocardial infarction) – across four national health record sources in England: primary care, hosptal care, disease registry and death records. Previous studies have typically compared only one or two electronic sources.

They identified 21,482 patients with a record of acute myocardial infarction in one or more of the four data sources. Risk factor profiles and one year all cause mortality rates were comparable across records from different sources.

However, they found that each data source missed a substantial proportion of cases. For example, only one third of non-fatal myocardial infarctions were recorded in all three data sources (primary care, hospital care and disease registry), while two thirds were recorded in two sources.

Primary care records were the single most complete source of non-fatal myocardial infarction records (not recording one quarter), hospital records missed one third and the disease registry nearly half. In other words, acute myocardial infarction was underestimated by 25–50% using one source compared to using all three.

"With the current emphasis on measuring clinical outcomes in health systems and recent plans to use linked data to drive improvements in the care of patients with cardiovascular disease, our study has important implications for practice and policy," say the authors. And they say future research should focus on areas such as improving how data are coded, understanding how linkages with primary care, admission to hospital and mortality data compare, and evaluating the quality of the data available in these linked data.
Continue reading
    Share:
The ONC has released the Governance Framework for Trusted Electronic Health Information Exchange. The Governance Framework reflects the principles in which ONC believes when it comes to the policy set for HIE governance. This framework is intended to provide a common foundation for all types of governance models. Entities that set HIE policy should look to the Governance Framework’s principles as a way to align their work with national priorities. The four key categories of principles discussed in the Governance Framework include:
  1. Organizational Principles: Identify generally applicable approaches for good self-governance;
  2. Trust Principles: Guide HIE governance entities on patient privacy, meaningful choice, and data management in HIE;
  3. Business Principles: Focus on responsible financial and operational policies for governance entities, with emphasis on transparency and HIE with the patients best interests in mind;
  4. Technical Principles: Express priorities for the use of standards in order to support the Trust and Business Principles as well as furthering the execution of interoperability.
The Governance Framework’s intended audience includes any entities that set HIE policy such as: State governments, public-private partnerships, health information exchange organizations (HIOs), and private companies, but is not meant to speak directly to “users” of the exchange services governed by such entities. As Steven Posnack, Director of the Federal Policy Division at ONC and health IT policy wonk extraordinaire  said at the NeHC HIE Governance Forum in announcing the framework, "These principles are the pillars of health information exchange governance." A very important part of the strategy, and one of these pillars, are the Trust Principles, which would require that an entity that sets HIE policy is responsible for creating an environment in which patients should:
  1. Be able to publicly access, in lay person terms, a “Notice of Data Practices.” Such notice would explain the purpose(s) for which personally identifiable and de-identified data, consistent with applicable laws, would or could be electronically exchanged (e.g., treatment, payment, research, quality improvement, public health reporting, population health management).
  2. Receive a simple explanation of the privacy and security policies and practices that are in place to protect their personally identifiable information when it is electronically exchanged and who is permitted to access and use electronic HIE services.
  3. Consistent with applicable laws, be provided with meaningful choice as to whether their personally identifiable information can be electronically exchanged.
  4. Consistent with applicable laws, be able to request data exchange limits based on data type or source (e.g., substance abuse treatment).
  5. Consistent with applicable laws, be able to electronically access and request corrections to their personally identifiable information.
  6. Be assured that their personally identifiable information is consistently and accurately matched when electronically exchanged.
National Coordinator Farzad Mostashari said in a blog post outlining the framework, "The Governance Framework reflects what matters most to ONC when it comes to national health information exchange governance and the principles in which ONC believes. We’ve published this framework to provide a common foundation for all types of governance models. Entities that set health information exchange policy should look to the Governance Framework’s principles as a way to align their work with national priorities." I encourage everyone interested in health data exchange to carefully read the Governance Framework: http://www.healthit.gov/sites/default/files/GovernanceFrameworkTrustedEHIE_Final.pdf

Continue reading
    Share: