1. 1 Jan 2013 © 2002-2013 Health Level Seven International ®, Inc. All Rights Reserved. HL7 International and Health Level Seven International are registered trademarks of Health Level Seven International, Inc. Reg. U.S. Pat & TM Off May 2014 Working Group Meeting May 6, 2014 CONSUMER IDENTITY AND PERSONAL HEALTH Presented by: Tim McKay, Ph.D., CISSP Kaiser Permanente

2. 2 Jan 2013 © 2002-2013 Health Level Seven International ®, Inc. All Rights Reserved. HL7 International and Health Level Seven International are registered trademarks of Health Level Seven International, Inc. Reg. U.S. Pat & TM Off Agenda State of Online Consumer Identity Identity and Healthcare The Value of Individually Identifiable Health Information Identity Standards

3. 3 Jan 2013 © 2002-2013 Health Level Seven International ®, Inc. All Rights Reserved. HL7 International and Health Level Seven International are registered trademarks of Health Level Seven International, Inc. Reg. U.S. Pat & TM Off Consumer Identity in 2014 A fragmented space of N of 1 solutions o One set of credentials = access to one service o Exceptions: facebook, Google o One factor dominant o Exceptions: Google, ebay, some financial institutions o No population sensitivity A (largely) self-asserted space Convenience over privacy o Site driven o Consumer driven

4. 4 Jan 2013 © 2002-2013 Health Level Seven International ®, Inc. All Rights Reserved. HL7 International and Health Level Seven International are registered trademarks of Health Level Seven International, Inc. Reg. U.S. Pat & TM Off Consumer Identity in Healthcare Who you are matters... sometimes o Stand-alone app vs. connections to medical records Privacy matters... sometimes o HIPAA and non-HIPAA entities o Metadata and “anonymous” uses of data o Social media credential use Portability matters... sometimes o HIE initiated o Consumer initiated  Zero reuse of consumer credentials between health systems  No metadata standards to enable accurate record matching.  No accepted standards for account creation and maintenance.

5. 5 Jan 2013 © 2002-2013 Health Level Seven International ®, Inc. All Rights Reserved. HL7 International and Health Level Seven International are registered trademarks of Health Level Seven International, Inc. Reg. U.S. Pat & TM Off Why is an individual’s health information of value to others? Use to obtain health care services o Physical o Virtual Use to market goods and services Use for general identity spoofing for financial gain o Demographic information o Financial information o Health information for targeted individuals  Sale of celebrity information  Blackmail Exercise control over another

6. 6 Jan 2013 © 2002-2013 Health Level Seven International ®, Inc. All Rights Reserved. HL7 International and Health Level Seven International are registered trademarks of Health Level Seven International, Inc. Reg. U.S. Pat & TM Off Developing standards for consumer health identities Why are identity standards important? o Reduce inappropriate disclosure o Ensure the integrity of an individual’s medical record National Institute of Standards and Technology (NIST) 800-63-2 (Electronic Authorization) 800-162 (Role Based Access) National Solution for Trusted Identities in Cyberspace (NSTIC): Identity Solutions will be o Privacy enhancing and voluntary o Secure and resilient o Interoperable o Cost effective and easy to use Identity Ecosystem Steering Group o Promotes goals of NSTIC o Quarterly plenary—ongoing workgroups (including healthcare) o Focus on demonstration projects and an identity framework o Not currently planning to be a standards organization

7. 7 Jan 2013 © 2002-2013 Health Level Seven International ®, Inc. All Rights Reserved. HL7 International and Health Level Seven International are registered trademarks of Health Level Seven International, Inc. Reg. U.S. Pat & TM Off Creating Consumer Health Identity Standards Account Creation and Identity Provisioning o Identity proofing o User ID rules o Password rules... or maybe not Authentication o Account controls o Multi-factor authentication o Biometric use Establishment of Account Proxy Identities Account Maintenance o Forgot user ID and forgot password o Account de-provisioning o Account reinstatement o Suspected fraudulent use Identity portability o Meta data for identity assertion o “Home” and “Guest” account rules

8. 8 Jan 2013 © 2002-2013 Health Level Seven International ®, Inc. All Rights Reserved. HL7 International and Health Level Seven International are registered trademarks of Health Level Seven International, Inc. Reg. U.S. Pat & TM Off Issues Consumer Health Identity Standards Must Address Controls which backfire o Increasing password strength and length o Password expiration Controls which are population relevant o Who is the target user? o How are needs of vulnerable populations addressed? Controls which respect autonomy o Set minimum bars o Raise the bars for higher-risk transactions  Data transfer to third parties  New cross-entity identity assertions o Provide enhanced controls on an elective basis

9. 9 Jan 2013 © 2002-2013 Health Level Seven International ®, Inc. All Rights Reserved. HL7 International and Health Level Seven International are registered trademarks of Health Level Seven International, Inc. Reg. U.S. Pat & TM Off Consumer Identity and Personal Health THANK YOU Tim McKay tim.a.mckay@kp.org