Protecting “High Stakes” PHI HITSS It Out of the Park 9 April 2015
Harmonization Act Signed into law by Governor Neil Abercrombie on July 10, 2012, HB 1957 - Relating to Health Care Information harmonizes more than 50 existing state medical privacy laws with the federal Health Insurance Portability and Accountability Act (HIPAA)
Harmonization Act “The new law reinforces the safe and secure exchange of clinical information and ultimately enables health care providers to improve the quality of patient care they provide without compromising privacy protections,” –Christine Sakuda
Harmonization Act Essentially says: Compliance with HIPAA = compliance with all state laws What if the State law is more stringent? Doesn’t matter
What do we mean by High Stakes PHI? Sensitive data? Some forms of PHI is more sensitive than others… Examples?
Segmenting Data Privacy Special handling for specific parts of an electronic health record Behavioral health Mental health There is only a specific law that pertains to Alcohol and Drug Abuse (42 CFR part 2) Certain records for DVA facilities Those records requested by patients to be sequestered
Data Segmentation for Privacy (DS4P) Defined use cases based on the previous regulation Specific privacy policies that can be electronically supported through data segmentation techniques Specific enough to be addressed despite the harmonization act in states like Hawaii
DS4P Could go a long way toward protecting information when data breaches are occurring Could align with international requirements: PHIPA Lock box provisions Lock up information from any particular person or Lock up entire records or segments from everyone US organizations complete this manually
DS4P Some vendors are placing DS4P ideas and technical specifics into their new products Challenges continue What do you think about the future of Data Segmentation for Privacy?