Health Information Security and Privacy Collaborative (HISPC) Overview John K. Evans Mike Berry VHITP Workgroup Call – April 4, 2007

Health Information Security and Privacy Collaboration Initiative HISPC’s Goals for the Privacy and Security Assessment Project 1. Identify and develop best practices to: Resolve barriers to health information exchange Propose solutions to address identified challenges 2. Get stakeholders involved, participating and contributing Seek consensus-based solutions and implementation plans in communities to increase local expertise about health information privacy and security protection 3. Support collaboration within and among states to: Foster stakeholder participation Maximize knowledge exchange Identify common solutions

Stakeholder Groups Pharmacies Clinicians Long-term care facilities Nursing homes Homecare and hospice Correctional facilities Professional associations and societies Medical and public health schools State government entities Clinicians Physician groups Federal health facilities Hospitals Payers (including employers that sponsor health plans) Public health agencies Community clinics Labs Individual consumers and consumer organizations

Consumer Focus Groups What is consumers' level of knowledge and assumptions about what is currently happening with PHI and health information exchange (HIE)? How do they feel about the benefits of HIE vs. the risk that the information could be misused? What are their thresholds for and views about authentication, audit, and access control? What needs to be in place (i.e., protections) in order for consumers to feel comfortable about their PHI being shared? If their PHI were available to them electronically, would they make use of it themselves, and how? What is the best way for them to learn/be educated about PHI and HIE? In short, what are their concerns and what are solutions?

HISPC Tasks 1. Assess variation in organization-level business policies and state laws Interim assessment of variation report 2. Formulate interim solutions and implementation plan Interim analysis of solutions report Interim implementation plan report

Major Themes: Variations Infrastructure needed to support interoperability greatly lacking. Infrastructure needed to support intraoperability greatly lacking. Entity authentication procedures are highly variable and are not reliable. Redundancy and inconsistency of consent between entities to exchange health information to treat patient.

Major Themes: Variations There is a wide variation in the ways in which payers interface with health care entities. IRB oversight includes a review of how information will be stored, but not necessarily exchanged. There is some disagreement among stakeholders that they would or would not obtain PHI under specific scenarios.

Major Themes: Variations HR departments are dealing with issues of access control, security of physical plant and packaging of PHI as it relates to employee records, specifically related to ADA compliance, Family Leave and return to work related laws and policies. The granularity, complexity and thoroughness of privacy and security measures is related to the amount of PHI that is exchanged and/or the sensitive nature of the health conditions. Under urgent circumstances PHI is shared more readily without patient consent.

Solutions  Implementation Plan State-proposed solutions Education Infrastructure Framework for Privacy & Security Technology Requirements Solutions for Role-based Access Control Patient Control “Break the Glass” National-level recommendations Correlating Patient Records Patient Consent

Implementation Deliverables Identify barrier Provide solution overview Summary of effective practices Planning assumptions and decision Implementation scope: Ownership and responsibilities Identification of required tasks Timeline and milestones Projected costs and required resources Possible barriers Impact on affected stakeholders Means of tracking, measuring and reporting progress

HIE Commission Concept Concept of an independent entity raised in 4 solutions Consistent with HIT Plan VHITP Principles: I: Vermonters will be confident that their health care information is secure and private and accessed appropriately. 32: Plan as a Living, Evolving Document

Next Steps Final Solutions Report Meet with VITL Executive Committee Final Implementation Report Questions or Comments Welcome