Privacy and Security Solutions For Interoperable Health Information Exchange Presented by Linda Dimitropoulos, PhD RTI International Presented at AHRQ Annual Meeting September 27, 2007 RTI International is a trade name of Research Triangle Institute 3040 Cornwallis Road ■ P.O. Box ■ Research Triangle Park, NC Phone

Background Variation in privacy and security business practices, policies, and state laws creates a barrier to electronic clinical health information exchange Consumers, organizations, and state and federal entities share concerns related to maintaining the privacy and security of health information The existing paradigm for privacy and security protections does not fully accommodate active consumer participation in health information exchange

Assumptions Decisions about how to protect the privacy and security of health information should be made at the local level Stakeholders at the state and community levels, including patients and consumers, must be involved in identifying the challenges and developing solutions to achieve broad- based acceptance Discussions need to take place to develop an understanding of the current landscape and the variation that exists between organizations within each state, and ultimately across the nation

Methodology Community-based participatory research model where state teams identify and “own” the issues and outcomes Engaged broad range of stakeholders to identify challenges to privacy and security and develop solutions Followed a “core” methodology that framed discussions in terms of purposes for the exchange and the type of health information being exchanged within 9 domains of privacy and security

Stakeholder Participation in Assessment of Variation Total Participants3, Stakeholder Group NAVG Providers1,63048 Technology and Health Information Experts Consumers Other Government Public Health Agencies/Departments Employers Legal Counsel/Attorneys Medical & Public Health Schools/Research Payers Law Enforcement and Correctional Facilities 37 1 Foundations/Other Policy Consultants 4<1

Challenges/Solutions Challenge: Lack of awareness among stakeholders Stakeholders lack sufficient knowledge of HIT/HIE to understand implications for privacy and security; Consumers are unaware of legal protections under state law; Providers frequently do not understand state law requirements Solution: 14 states are developing model outreach and education programs Consumer and provider outreach and education State and multistate privacy and security summits Consumer advisory councils/committees Toolkits for educating stakeholders

Challenges/Solutions (continued) Challenge: Variation created by state privacy and security laws State law governing privacy and security is scattered, fragmented, sometimes inconsistent or contradictory within a state, and frequently does not apply sensibly to electronic exchange. Solution: 9 states implementing solutions related to state law Producing a catalog of existing relevant statutes and administrative regulations Developing a road map of current P&S laws/statutes Developing model legislation to harmonize on multistate issues such as consent Completing a legal analysis to determine what changes need to be made to ensure privacy and security Reforming state privacy laws to address electronic HIE Drafting legislation for 2008 session

Challenges/Solutions (continued) Challenge: Obtaining and Managing Patient Consent Broad variation in the requirements for obtaining and managing patient consent and authorization for information disclosures Solution: 8 states are working on reducing variation related to consent management Standardize patient consent process Harmonize consent language that addresses opt-in/opt-out issues across the state Implement consent management process; develop use cases that drive HIE transactions Create guiding principles for consent that can be used to update state law Model consent forms

Challenges/Solutions (continued) Challenge: Variation in Methods of Implementing 4 A’s Need for consensus on standards for authentication, authorization, access controls and information audits to reduce mistrust between entities Solution: 4 states are working on issues related to the 4A’s Defining minimum standards for authentication acceptable to individuals or entities participating in an HIE Defining P&S requirements for providers' role-based access and authentication Developing “solutions building block” i.e., trusted digital identities for authentication, authorization, access control, data integrity, and digital signatures

Challenges/Solutions (continued) Challenge: Privacy and Security Oversight Lack of state-level authoritative governing bodies to oversee the development, adoption and enforcement of common privacy policies and security practices for HIE Solution: 6 states working on governance and oversight Establish Governor’s eHealth taskforce on Privacy and Security Create a Privacy and Security Advisory Board Establish formal work group to formulate and review P&S policy Create an umbrella organization to operationalize P&S strategies and interact with Governor's HIE Commission and the state Health Policy Authority.

Moving Forward Moving to multi-state collaboration Enlisting the remaining states and territories into the process Providing the technical assistance needed to foster the multi-state collaborative work 2 nd National Meeting November 1-2 in Washington, DC

Thank You