Access and Authorisation in a Glocal e-Health Policy Context Session II - Access Control to Information and Authorisation Management Richard E Scott, Penny A Jennett, Maryann Yeo Health Telematics Unit Faculty of Medicine, University of Calgary IMIA Working Group 4 Conference; Varenna, Italy 31 May – 3 June 2003 Global e-Health Research and Training Program Health Telematics Unit

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Terminology Global e-Health e-Health TelehealthTelematics (Info(r)matics) ‘Network Age’ Global Health Globalisation

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Access and Authorisation Needs / Rights Privacy / Confidentiality Access / Authorization The Citizen The ‘System’

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott A Borderless World ……. Global e-Health RealityPotential Embrace

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Policy Role Integration Policy Evidence

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Policy ? Importance: Policy determines the rate and direction of development of healthcare initiatives Definition - e-Health Policy: “A set of statements, directives, regulations, laws, and judicial interpretations that direct and manage the life cycle of e-health”

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott But …. “…policy in any single jurisdiction may hamper or even cripple the ability of telehealth to fulfill it’s potential.” * Need: Build GeH Policy through – Common principles Complementarity of policy * Scott RE, Chowdhury MFU, Varghese S. Telehealth policy – looking for global complementarity. J Telemed Telecare 2002;8(6)-Supp3;55-58.

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Canadian Initiatives Examples of efforts to develop clear tools and strategies to address access and authorisation, and other policy issues. NIFTE PPP GeH Policy Model

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott National Initiative for Telehealth (NIFTE) Guidelines Framework of Guidelines

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott National Initiative for Telehealth (NIFTE) Guidelines Goal: Address current lack of telehealth standards and guidelines Primary project outcome: Framework of pan-Canadian guidelines Target: Regulated health professionals Telehealth provider organizations Accrediting agencies (CCHSA)

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott National Initiative for Telehealth (NIFTE) Guidelines Foci: Organizational Leadership Readiness Accountability Assuring Quality Continuity Human Resources Roles and Responsibilities Licensure and Related Issues Competency and Qualifications Education, Orientation and Training Reimbursement

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott National Initiative for Telehealth (NIFTE) Guidelines Foci: Technology and Equipment Procurement Practices Security Diagnostic Quality Reliability Acceptability Interoperability Scalability Safety Maintenance Current Standards and Guidelines

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott National Initiative for Telehealth (NIFTE) Guidelines Foci: Clinical Standards and Outcomes Duty of Care Communication with Patients/Clients Standards/Quality of Clinical Care Clinical Outcomes Patient/Client Confidentiality Informed Consent

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Policy and Peer Permission (PPP)

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Policy and Peer Permission (PPP) Goal: Address need for secure access and authorization Primary project outcome: Medical software – ‘rules-based’ system for use with EHR (Electronic Health Record) Medical policy - a ‘starter set’ of workable policy statements

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Policy and Peer Permission (PPP) Feature - controls access to confidential records via policy Traditional - access to files are controlled by “access lists” PPP - policy based system that relies on rules Advantage - scalability

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Policy and Peer Permission (PPP) Unique feature: Rights Enforcer technology Advantage – ‘persistent security’ Issue – security breaches (forwarding of confidential information)

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Policy and Peer Permission (PPP)

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Glocal e-Health Policy Grid Goal: Facilitate and encourage Glocal e-Health Policy development Primary project outcome: Framework / Model for e-Health Policy Practical tool for both users and researchers

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott ‘Glocal’ global + local = glocal Kickbusch I. Global + local = glocal public health [editorial]. Journal of Epidemiology and Community Health. 53(8) (1999) pp In our networked world; what happens locally has global impact, and what happens globally has local impact.

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Glocal e-Health Policy Grid ACTORS: International Bodies NGO’s Private Sector Governments Institutions Agencies Professional Groups / Associations Public LEVELS: Patient / Provider Program Organisation / Facility Regional Provincial National Global

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Glocal e-Health Policy Grid THEMES: Professional Operational Institutional Ethical Legal Cultural Commercial Communication Interoperability ISSUES: Institutional Protection of Personal Health Information Accreditation Access Authorisation Data Collection and Management Data Quality Training Certification Insurance

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Glocal e-Health Policy Matrix Model Eight Policy Levels Nine Policy Themes Eight Actor Categories Policy ‘Issues’ at each point of intersection Policy Levels Policy Themes PolicyActors

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Policy – Perspective! Punctuate : “A woman without her man is nothing.” A woman, without her man, is nothing. A woman: without her, man is nothing.

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Challenges Intra-Jurisdictional: Between facilities within single jurisdiction (e.g. Health Region)

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Challenges Inter-Jurisdictional: Between major facilities across one or more ‘borders’

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Challenges Inter-Jurisdictional: Between any facility across any domestic border

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Challenges Global e-Health: “Anyone, anytime, anywhere” (CST)

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Access and Authorization ‘Glocal’ Perspective - Security and privacy issues of - the ‘citizen’:  the occasional patient  the acute patient  the geriatric patient  the patient in emergency conditions  the healthy citizen

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott ‘Our’ solutions must fit ‘their’ needs too ! Developing Countries: 80 % of the global population

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott - Summary - Ongoing ‘access’ and ‘authorization’ activity: 1. Develop clear tools and strategies, e.g. 1. Embed within existing ‘Health Policy’ first 2. Ensure persistent security 2. Recognise the broader policy context, e.g. i. Common principles ii. Complementary local, domestic, and global policy iii. Maintain a ‘Glocal’ perspective at all times

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott - Summary - Ongoing ‘access’ and ‘authorization’ activity: 3. Encourage interaction and coordination among related groups: 1. International Security Trust & Privacy Alliance ( - business orientedwww.istpa.org 2. WHO / PAHO / …….

May-June 2003IMIA WG4; Varenna; Dr. Richard Scott Global e-Health: “Anyone, anytime, anywhere”