Privacy and Security Domains and Solutions

1
Privacy and SecurityDomains and Solutions

• Variations Work Group Meeting
• Tampa, FL
• July 12, 2006

2
Assessment of Business PracticesProcess
Identify and Code Business Practices
Identify Legal Drivers
Identify Solutions
Identify Business Policies
3
Assessment of Business PracticesImplementation
Plan
Implementation Work Group
Implementation plans for each state
Broad Stakeholder Consensus
4
Privacy and SecurityDomains

• User and Entity Authentication
• Authorization and Access
• Patient and Provider Identification
• Encryption Protocol
• Protections from Modification
• Monitoring and Audits of Activity
• Administrative and Physical Security
• State Law Restrictions
• Information Use and Disclosure Policies

5
RTI Scenarios

• Healthcare Operations and Marketing
• Bioterrorism
• Employment
• Public Health
• Health oversight

• Patient Care
• Security and Access
• Payment Scenario
• RHIO
• Research Data Use
• Access by Law Enforcement
• Pharmacy Benefit

6
Florida Scenarios

• Medicaid
• RHIO
• Personal Health Record

7
RTI 1 Patient Care Scenario A

• The emergent transfer of health information
  between two healthcare providers when the status
  of the patient is unsure.
• What is your business practice?
• Domain Addressed by practice?

8
FL 1 Medicaid

• A physician treating a former Medicaid patient at
  a rural health clinic needs information on the
  patients congestive heart failure treatment
  regimen. The doctor decides to access the
  Medicaid EHR. The patient gives oral consent.

9
RTI 8 Use by Law Enforcement

• An injured nineteen (19) year old college student
  is brought to the ER following an automobile
  accident. It is standard to run blood alcohol and
  drug screens. The police officer arrives in the
  ER in addition to the patients parents. The
  police officer requests a copy of the blood
  alcohol test results and the parents want to
  review the ER record and lab results to see if
  their child tested positive for drugs. These
  requests are made to the ER staff. The patient
  is covered under their parent's health and auto
  insurance policy.