General Session/ Presentation: “Cross Training: Security Best Practices from Other Industries”.

Mick Talley: Mick Talley: The Financial Services Perspective. The Financial Services Perspective. Chair: HIMSS Security & Privacy Chair: HIMSS Security & Privacy Task Force. Task Force. Recently completed whitepaper on “Crafting Healthcare Identify Management on Industry Best Practices”. “Crafting Healthcare Identify Management on Industry Best Practices”.

“Lessons from Financial Services” -- Begin with point of view that “the providers, insurance companies, and the banks have an equal interest in validating that the individual is “who they say they are.” -- Goal: Accurate identification of an individual and the linking of all that individual’s related health information within and across healthcare and financial institutions.

ONC Final Report ONC Final Report Feb. 7, 2014 “Patient Feb. 7, 2014 “Patient Identification and Matching” Identification and Matching” Basic Principles: --Patient safety and quality of care. --Improvement should reflect a real world impact on the workflow of clinical impact on the workflow of clinical and administrative personnel. and administrative personnel. --Improvements should be multi-faceted and incremental with no single solution and incremental with no single solution or step which is final. or step which is final.

ONC Final Report: ONC Final Report: Feb. 7, Feb. 7, Improvements should apply to all sizes And types of provider settings, with a broad set of use cases, involving multiple stakeholders across networks of multiple IT platforms. --We need to test and validate the use of authentication technologies and increase the comfort level of diverse stakeholders across networks. --HIMSS Task Force Conclusion. (July 2014) --HIMSS Task Force Conclusion. (July 2014)

Five Authentication Five Authentication Processes deployed by financial institutions: 1.) Something you know, you have, your are. 2.) Pre-shared secret, such as User ID & password, with PIN. 3.) Asymmetric cryptographic key pairs, one private and one public. 4.) One-time passwords. 5.) Bio-metric combined for two-factor authentication for NIST , Level 3 of assurance.

Task Force Recommendation: “The healthcare industry might best be served by conducting a set of pilots of each of the five processes that include a method of monitoring the success of each against a common criteria”. --HIMSS Task Force for Security & Privacy, July 2014.

Mick Talley Southeast Michigan Health Information Exchange. (SEMHIE)