1. Configuring Electronic Health Records Privacy and Security in the US Lecture a This material (Comp11_Unit7a) was developed by Oregon Health & Science University funded by the Department of Health and Human Services, Office of the National Coordinator for Health Information Technology under Award Number IU24OC000015.

2. Privacy and Security in the US Learning Objectives Compare and contrast the concepts of privacy and security (Lecture a) List the regulatory frameworks for an EHR (Lecture b, c) Describe the concepts and requirements for risk management (Lecture d) Describe authentication, authorization and accounting (Lecture d) Describe passwords and multi-factor authentication and their associated issues (Lecture d) Describe issues with portable devices (Lecture d) Describe elements of disaster preparedness and disaster recovery (Lecture e) Describe issues of physical security (Lecture e) Describe malware concepts (Lecture f) 2 Health IT Workforce Curriculum Version 3.0/Spring 2012 Configuring Electronic Health Records Privacy and Security in the US Lecture a

3. Privacy and Security in the US Definitions Compare and contrast the concepts of privacy and security Privacy –Policy: Legal and organizational requirements Security –Implementation of policy 3 Health IT Workforce Curriculum Version 3.0/Spring 2012 Configuring Electronic Health Records Privacy and Security in the US Lecture a

4. Privacy Stakeholders The Patient Family members Clinicians Staff 4 Health IT Workforce Curriculum Version 3.0/Spring 2012 Configuring Electronic Health Records Privacy and Security in the US Lecture a

5. More Stakeholders Legal professionals Law enforcement Criminals Hackers 5 Health IT Workforce Curriculum Version 3.0/Spring 2012 Configuring Electronic Health Records Privacy and Security in the US Lecture a

6. What Should Be Private? Who the patient is The patient’s medical information The patient’s financial information How to identify the patient Spelled out in great detail in Federal and state regulations 6 Health IT Workforce Curriculum Version 3.0/Spring 2012 Configuring Electronic Health Records Privacy and Security in the US Lecture a

7. How is Privacy Maintained? Policies and procedures Environment where privacy is respected Code of ethics Culture of respect 7 Health IT Workforce Curriculum Version 3.0/Spring 2012 Configuring Electronic Health Records Privacy and Security in the US Lecture a

8. Consequences Huping Zhou, UCLA researcher Sentenced to 4 months in prison in 2010 Accessed confidential records of supervisors and celebrities without a valid reason or authorization 8 Health IT Workforce Curriculum Version 3.0/Spring 2012 Configuring Electronic Health Records Privacy and Security in the US Lecture a

9. Relationship Between Privacy and Security Security without privacy Privacy without security? 9 Health IT Workforce Curriculum Version 3.0/Spring 2012 Configuring Electronic Health Records Privacy and Security in the US Lecture a

10. Who is Responsible for Privacy and Security? Personal responsibility Professional responsibility 10 Health IT Workforce Curriculum Version 3.0/Spring 2012 Configuring Electronic Health Records Privacy and Security in the US Lecture a

11. What Should Be Secure? Private medical and financial information To achieve that end, we need to secure –Physical locations –Records –Systems –Networks 11 Health IT Workforce Curriculum Version 3.0/Spring 2012 Configuring Electronic Health Records Privacy and Security in the US Lecture a

12. How is Security Maintained? AAA - Authentication, Authorization and Accounting Firewalls IDS/IPS – Intrusion Detection and Prevention Systems Audit log review Encryption etc. 12 Health IT Workforce Curriculum Version 3.0/Spring 2012 Configuring Electronic Health Records Privacy and Security in the US Lecture a

13. Privacy and Security in the US Summary – Lecture a Relationship between privacy and security Definition of privacy Definition of security Privacy in health information 13 Health IT Workforce Curriculum Version 3.0/Spring 2012 Configuring Electronic Health Records Privacy and Security in the US Lecture a

14. Privacy and Security in the US References – Lecture a References Dimick, C. (2010, August 9, 2010). Californian Sentenced to Prison for HIPAA Violation. Retrieved Jan 2012 from http://journal.ahima.org/2010/04/29/californian-sentenced-to-prison-for-hipaa-violation. http://journal.ahima.org/2010/04/29/californian-sentenced-to-prison-for-hipaa-violation 14 Health IT Workforce Curriculum Version 3.0/Spring 2012 Configuring Electronic Health Records Privacy and Security in the US Lecture a